Authentication

Every request to the Pushrail API requires a Bearer key in the Authorization header:

Authorization: Bearer pr_pro_…

Keys are issued per workspace per environment from the dashboard. The key prefix encodes its environment:

| Prefix | Environment | |---|---| | pr_dev_… | Development | | pr_sta_… | Staging | | pr_pro_… | Production |

Keys are tenant- and environment-scoped: a Development key cannot reach Staging or Production data, and vice versa. All requests go to the same host, https://api.pushrail.io, the environment comes from the key, not the URL.

Errors

A missing or malformed key returns 401 Unauthorized with the standard error envelope:

{ "code": "unauthenticated", "message": "Missing bearer token." }

An expired or revoked key returns 401 with code: "invalid_key".

Rotation

Rotate keys from the dashboard. Old keys remain valid for 24 hours after rotation to give clients time to roll forward. After 24 hours, requests with the old key return 401 invalid_key.