Skip to content
Steward Developers
Back to Steward

Authentication

The Steward API authenticates every request with an API key, sent as a bearer token in the Authorization header. This guide covers where keys come from, the key format, and how to keep them secure.

Obtaining a key

Section titled “Obtaining a key”

API keys are provisioned through your Steward account — contact your Steward representative to have one created. There is no self-serve key management screen today.

The raw key is shown only once, at creation. Steward stores only a hash of it and can never show it to you again, so capture it and store it somewhere secure (a secrets manager) at that moment. If you lose it, request a new one.

Key format and environments

Section titled “Key format and environments”

A key is a bearer token whose prefix reflects the environment it was created in:

PrefixEnvironment
stw_live_…Production (api.getsteward.ai)
stw_test_…Sandbox / non-production

Use a key against the environment it was issued for. Send it on every request:

Terminal window
curl https://api.getsteward.ai/api/v1/applications \
  -H "Authorization: Bearer stw_live_your_api_key_here"

Testing requests in these docs

Section titled “Testing requests in these docs”

On any API reference page, select Test Request, then open Auth. Leave apiKey selected and paste the raw API key (stw_live_… or stw_test_…) into Bearer Token. Do not include the Bearer prefix; the client adds it to the Authorization header automatically.

Before sending, choose the matching server and environment for the key, then fill in any required path parameters or request body fields. Test Request runs in your browser, so use it only on a trusted device. Closing the Test Request modal does not clear the key: clear the Bearer Token field when you finish, or reload or close the tab.

Scope

Section titled “Scope”

Each key has full access to the account that owns it — there is no per-key scoping. Treat a key as an account-wide credential: keep it server-side only, and never embed it in client-side code, a public repository, or a URL. You can hold multiple keys for an account (for example, one per integration).

Rotation and revocation

Section titled “Rotation and revocation”
  • Revoke a key the moment it may be compromised. A revoked key stops working immediately.
  • Rotate by requesting a new key, moving your integration onto it, and then revoking the old one — there is no in-place rotation, and because you can hold several keys at once you can cut over with no downtime.
  • Keys can also be issued with an expiry date, after which they stop working automatically.

Contact your Steward representative to revoke a key or issue a replacement.

Next steps

Section titled “Next steps”