Authenticate an HTTP request.

Two credentials reach this API, and they are not interchangeable. This page is the REST-specific mechanics; the shared authentication concepts live on the Developer Hub.

Server-to-server: a scoped API key

Send the key in X-Api-Key. Create one per application and per environment so a single revocation is never a platform-wide outage.

curl -s https://api.eventium.ai/api/health \
  -H "X-Api-Key: $EVENTIUM_API_KEY"

Keys are created and revoked in the API keys console. Keep them in a secret manager. Never place a key in browser storage, source control, a query string, a redirect URL, or a generated artifact.

Scopes

A key carries explicit scopes, and the key's scopes are a ceiling, not a grant: the subject must independently hold the entitlement and the membership for the resource it names.

Scope	Permits
`memory.read`	Reading authorized Atlas memory.
`memory.write`	Writing to authorized Atlas memory.
`search.read`	Search over authorized content.
`representation.read`	Reading derived representations.

A scope outside this set is rejected at key creation rather than silently ignored.

Browser: the session cookie

Signed-in product surfaces and the key console itself use the API-owned session. The cookie is Secure and HttpOnly, so JavaScript cannot read it; read the session state from GET /api/auth/session instead, which also returns the CSRF token.

const response = await fetch("https://api.eventium.ai/api/auth/session", { credentials: "include" });
const session = await response.json();

State-changing browser requests are origin-checked. A POST, PATCH or DELETE from a browser must carry the CSRF token and must come from an allowed origin. This is why the keys console and the API Explorer are served from api.eventium.ai itself rather than from the documentation host: same-origin is a security boundary here, not a layout decision.

What a refusal means

Status	Meaning	Do
`401`	No credential, or it is not valid.	Send the key, or sign in. Do not retry unchanged.
`403`	Authenticated, but scope, role, entitlement or policy denied it.	Request authorization. Never work around this in frontend state.
`429`	A rate or quota boundary.	Back off when the response says the condition is retryable.

The full envelope and the retry rules are in schemas and errors.

API keys
Create, name and revoke scoped keys. API Explorer
Read an operation, then send it as a real request. Schemas and errors
The envelope, codes and retry rules.