Skip to main content

​
Authentication

All Task Execution API endpoints require authentication. You can authenticate using either an API key (for server-side integrations) or a JWT token (for browser-based widgets).
For browser-based integrations where code is visible to end users, use Widget Authentication with short-lived JWTs instead of exposing API keys.

​
API Key Authentication

​
Getting Your API Key

API keys are created through the Console:
  1. Log in to your Sigmic AI account
  2. Open the Console and select a project
  3. Go to the API Keys tab in project settings
  4. Click Create API Key
  5. Give your key a name and optional expiration
  6. Copy and securely store the generated key
The secret key is only shown once during creation. Store it securely immediately - you won’t be able to see it again.
API keys are scoped to projects. Tasks created with an API key use the configuration (MCP servers, skills, tool policies) from that key’s associated project.

​
Using Your API Key

Include your API key in every request using one of these methods:

​
Option 2: X-API-Key Header

​
API Key Format

API keys follow this format:
Example:

​
Example Request

​
JWT Authentication (Widgets)

For browser-based widgets and embedded UIs, use short-lived JWT tokens instead of API keys. See the Widget Authentication guide for the full setup flow.

​
Using a JWT

JWT tokens work with all the same Task API endpoints as API keys. The auth middleware auto-detects the format based on the token prefix.

​
Authentication Errors

​
Organization Context

API keys are scoped to projects, and projects belong to an organization. When you authenticate with an API key:
  • Tasks run using the project’s configuration (MCP servers, skills, tool policies)
  • Usage is tracked at the organization level
  • Only organization members with access to the project can manage its API keys
The JWT tokens issued on login include the user’s orgId and orgRole claims, which are used for authorization across all endpoints.

​
Security Best Practices

API keys should only be used in server-side code. Never include them in JavaScript that runs in the browser, mobile apps, or any code that could be inspected by users.
Store your API key in environment variables rather than hardcoding it in your source code.
Create new API keys periodically and disable old ones. You can manage multiple keys through the Settings panel.
Create separate API keys for development, staging, and production environments so you can revoke them independently if needed.