Skip to main content
Every request to the Scalysis API must be authenticated with a valid API key. Scalysis uses key-based authentication — there are no OAuth flows or session tokens to manage. You include your key in a request header, and Scalysis verifies it on every call. This page explains how to generate your key, which header format to use, and what to do if authentication fails.

​
Getting your API key

API keys are generated from the Scalysis dashboard. Log in at https://app.scalysis.com, open the Integrations section in the sidebar, and click API Keys. From there, click Create new key, give it a meaningful label so you can identify it later (for example, production-backend or staging-tests), and copy the key immediately after it is created. All Scalysis API keys begin with the prefix sca_ followed by a long random string, for example:
Your API key is shown only once at the moment of creation. If you lose it, you will need to revoke it and create a new one. Never share your API key in screenshots, support chats, or public code repositories — anyone with your key can make authenticated API calls on your behalf.

​
Using your API key

Scalysis supports two equivalent header formats for passing your API key. Use whichever fits better with your HTTP client or existing conventions — both grant the same level of access.
Both examples above are functionally identical. Pick one and use it consistently across your integration to keep your codebase easy to reason about.

​
Required headers for POST requests

Any request that sends a JSON body — such as triggering a call or creating a campaign — must also include the Content-Type: application/json header. Without it, the Scalysis API cannot parse the request body and will return an error.
GET requests, such as fetching a call outcome, do not require a Content-Type header because they carry no body.
As a rule of thumb: if you’re sending a -d flag (or any request body) in your HTTP client, always include Content-Type: application/json alongside your authentication header.

​
Authentication errors

If your API key is missing, malformed, or has been revoked, the Scalysis API responds with an HTTP 401 Unauthorized status and a JSON error body:
Common reasons for a 401 response:
  • You forgot to include the authentication header entirely.
  • You copied the key incorrectly — double-check for missing characters or accidental whitespace.
  • The key was revoked from the dashboard (for example, after a suspected leak).
  • You are using a key generated for a different Scalysis account.
If you suspect your API key has been compromised — for example, it was accidentally committed to a public repository — go to Integrations → API Keys in the dashboard and revoke the key immediately. Then generate a fresh one and update your environment variables or secrets vault. Revocation takes effect instantly, so any requests using the old key will fail from that point forward.