Authentication

Slate uses Bearer tokens to authenticate API requests. Each token is scoped to a single workspace and inherits the permissions of the workspace admin who created it.

Create an API token

Only workspace admins can create API tokens.

In Slate, open Workspace settings → API tokens (under Developer).
Click Create token.
In the Create API token dialog, enter a Name (for example, “CI pipeline”).
Under Expires, choose 7 days, 30 days, 90 days, or No expiry.
Click Create token.
In the Copy your new token dialog, click Copy token. The dialog also shows an example request you can copy.

The full token is shown only once. Store it in a secure location before closing the dialog. You cannot retrieve the token after this step.

The token starts with the slat_ prefix (for example, slat_K3x9m2...). The token list shows a preview for identification, but the full value is never displayed again.

Authenticate requests

Include the token in the Authorization header of every API request:

Authorization: Bearer slat_<your-token>

curl -s "https://api.slatehq.ai/workflow-service/api/public/v1/workflow-runs/run_x7k9m2p4" \
  -H "Authorization: Bearer slat_YOUR_TOKEN"

import requests

response = requests.get(
    "https://api.slatehq.ai/workflow-service/api/public/v1/workflow-runs/run_x7k9m2p4",
    headers={
        "Authorization": "Bearer slat_YOUR_TOKEN",
    },
)
data = response.json()

const response = await fetch(
  "https://api.slatehq.ai/workflow-service/api/public/v1/workflow-runs/run_x7k9m2p4",
  {
    headers: {
      "Authorization": "Bearer slat_YOUR_TOKEN",
    },
  }
);
const data = await response.json();

Token scope

Each token is tied to a specific workspace. The API enforces this scope:

Requests succeed only for resources within the token’s workspace.
If a request includes an X-Workspace-Id header, the header value must match the token’s workspace. A mismatch returns a 401 error.

Manage tokens

View active tokens

Go to Workspace settings → API tokens to see your workspace’s tokens. The table shows:

Token — the token name and a preview (first 12 characters + last 4 characters)
Created — the date and who created the token
Expires — the expiration date, or Never. Expired tokens are marked Expired.
Last used — when the token last made a request

Revoke a token

Go to Workspace settings → API tokens.
Open the ⋮ menu on the token’s row and choose Revoke token.
Click Revoke token to confirm.

Revocation takes effect immediately. Any system using the revoked token receives a 401 error on the next request.

Authentication errors

Status	Error	Cause
`401`	`unauthorized`	No `Authorization` header, missing `Bearer` prefix, or token does not start with `slat_`.
`401`	`unauthorized`	Token not found, has been revoked, or has expired.
`401`	`unauthorized`	Token validation returned an invalid workspace.
`401`	`unauthorized`	`X-Workspace-Id` header does not match the token’s workspace.
`401`	`unauthorized`	`X-Organization-Id` header does not match the token’s organization.
`403`	`forbidden`	The requested endpoint is not available for API token access.

Security best practices

Use expiring tokens (7, 30, or 90 days) for automated pipelines and rotate them regularly.
Give each integration its own token with a descriptive name. This makes it easy to revoke access for a single system without affecting others.
Never hard-code tokens in source code. Use environment variables or a secrets manager.
Revoke tokens you no longer need. Check the “Last used” date to identify unused tokens.

What’s next

API Overview — Base URL, request format, and available APIs.
Errors — Full list of error codes and response formats.
Create Workflow Run — Trigger a workflow using your token.

Getting Started

Workflows

Content Updates

AEO Tracker

Create an API token

Authenticate requests

Token scope

Manage tokens

View active tokens

Revoke a token

Authentication errors

Security best practices

What’s next

​Create an API token

​Authenticate requests

​Token scope

​Manage tokens

​View active tokens

​Revoke a token

​Authentication errors

​Security best practices

​What’s next

Create an API token

Authenticate requests

Token scope

Manage tokens

View active tokens

Revoke a token

Authentication errors

Security best practices

What’s next