Skip to main content
Identify and the rest of the workbench authenticate with a workspace API key. Loom accepts that same key on the relay path, or a short-lived session token on the direct path.

​
API keys

Create and revoke keys on the Developers page. Each key is a name, a public id (key_…), and a secret (sk_…).
  • The secret is a bearer token. Treat it like a password. Never put it in a browser or commit it.
  • The public id goes in a direct session token’s iss claim. It identifies the key; it authorizes nothing on its own.
  • A revoked key stops working immediately.
There is no test/live split. Create two keys and name them if you want two piles of traffic. Leftover sk_test_ secrets still authenticate and spend the same workspace balance. We charge outcomes, not requests: an identified result on Identify, a closed run on Loom that isn’t a platform failure. Promo credits cover first calls.

​
Loom: two ingress modes

The credential’s form selects the mode. A JWT bearer is direct. Anything else is a relay workspace API key. You do not declare a mode. Same trust model on both paths: we hold your public key, we never mint identity, and every tool call to your backend is signed. Walk through direct or relay.

​
Unauthorized requests

Requests without a valid key or token return 401 and an error envelope. Send Authorization on every call.