API Keys

API keys are the simplest way to authenticate requests to the PlanSched API. Every request must include your key in the Authorization header.

Overview

Each API key is scoped to a single workspace and inherits the permissions of the user who created it. Keys are prefixed with sp_live_ for production traffic and sp_test_ for sandbox use.

Creating an API key

In the PlanSched dashboard, open Developer and click New API key. Give it a memorable name, pick a workspace, and press Create. The secret is shown once — copy it somewhere safe.

sp_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

Using your API key

Pass the key as a bearer token in the Authorization header on every request.

curl https://api.plansched.com/developers/v1/accounts \
  -H "Authorization: Bearer $PLANSCHED_KEY"

Security best practices

• Never commit keys — store them in environment variables or a secret manager.
• Never expose in client code — call the API from a server you control, not the browser.
• Use one key per integration — so you can revoke a single client without breaking the rest.
• Rotate regularly — rotate keys every 90 days or immediately after any suspected leak.

Rotating & revoking keys

Any key can be deleted from the Developer dashboard. Revocation is immediate — the next request using that key will return 401 Unauthorized.