Authentication
All /v1/agents/* endpoints accept a Bearer token in the Authorization header.
API keys
Keys are minted from the Settings page in the Frontwind app. Each user gets one active key at a time — generating a new key revokes the previous one.
Keys are shown exactly once at generation. Frontwind stores only the SHA-256 hash in the database, so a leaked key is the only way to compromise an account — rotate it immediately if you suspect exposure.
Key format:
fw_live_a1b2c3d4e5f6...32-hex-charsHeader format
Authorization: Bearer fw_live_a1b2c3d4...Management endpoints
Key management uses your session cookie (i.e. you must be signed into the Frontwind app in the same browser). It is intentionally not callable from a third-party context.
| Method | Path | Description |
|---|---|---|
GET | /v1/keys | Return current key metadata (prefix, created_at). |
POST | /v1/keys | Mint a new key (rotates if one exists). Raw key shown once. |
DELETE | /v1/keys | Revoke the current key. |
Errors
Missing / invalid keys return:
HTTP/1.1 401 Unauthorized
{
"ok": false,
"error": { "code": "unauthorized", "message": "invalid API key" }
}