Start here
API keys and modes
Two kinds of key, two modes, one header. The key decides everything; there is no mode parameter to get wrong.
Authenticate every request with Authorization: Bearer <key>. Keys are shown once, at creation; only a hash is stored. Roll a key from the dashboard and the old one stops working immediately.
| Key | Where it lives | What it can do |
|---|---|---|
sk_test_… / sk_live_… | Your server, your secret manager | Everything: push, read, manage webhooks. |
pk_test_… / pk_live_… | A web page — safe to embed | Read public-tier data only. What the calendar widget ships with. |
Test keys write to an isolated partition you can reset from the dashboard (API keys → Danger zone). Live data has no reset. A publishable key that tries to write gets a 403 with publishable_key as the problem type.
Errors
Every error is an RFC 9457 problem document: a type URI, a human detail, and — for batch validation — an errors array with the index and JSON pointer of each rejected observation.