Authentication | Automat

Overview

All API requests to Automat require authentication using an API key. API keys are scoped to your organization and provide access to all extractors within that organization.

Keep your API keys secure! Never commit them to version control or expose them in client-side code.

Getting Your API Key

Log in to the Automat Dashboard
Navigate to Settings → API Keys
Click Create API Key
Give your key a descriptive name (e.g., “Production Backend”, “Development”)
Copy the key immediately — it won’t be shown again

You can create multiple API keys for different environments or services. Each key can be revoked independently without affecting others.

Using Your API Key

Include your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer YOUR_API_KEY

Example Request

curl -X POST https://studio.runautomat.com/api/extract \
  -H "Authorization: Bearer ak_xxxxxxxxxxxxx" \
  -F "extractorId=ext_abc123" \
  -F "file=@document.pdf"

Error Handling

If authentication fails, you’ll receive a 401 Unauthorized response:

{
  "error": "unauthorized",
  "message": "Invalid API key"
}

Common authentication errors:

Error	Cause	Solution
Missing Authorization header	No `Authorization` header provided	Add the header to your request
Invalid API key	Key doesn’t exist or was revoked	Check the key in your dashboard
Malformed header	Wrong format	Use `Bearer YOUR_KEY` format

Environment Variables

We recommend storing your API key in environment variables:

.env

AUTOMAT_API_KEY=ak_xxxxxxxxxxxxx

Node.js

Python

Go

typescript const apiKey = process.env.AUTOMAT_API_KEY;

API Key Best Practices

Use Environment Variables

Never hardcode API keys in your source code

Rotate Regularly

Periodically generate new keys and revoke old ones

Separate by Environment

Use different keys for development, staging, and production

Monitor Usage

Review API key activity in your dashboard