Authentication

Every request to the Core API is authenticated with an API key sent in the Authorization header using the ApiKey scheme:

Authorization: ApiKey YOUR_API_KEY

There are two kinds of keys, matching the platform hierarchy (organization → tenants → assistants):

Tenant keys#

The default. A tenant key authorizes requests against that tenant's resources only:

curl https://core-api.heysadie.ai/assistants \
  -H "Authorization: ApiKey TENANT_API_KEY"

Organization keys#

An organization key can act on any tenant that belongs to the organization, but every tenant-scoped request must say which tenant via the X-Tenant-Id header:

curl https://core-api.heysadie.ai/assistants \
  -H "Authorization: ApiKey ORG_API_KEY" \
  -H "X-Tenant-Id: 0195f1e2-1111-7000-8000-000000000000"

Where to get your keys#

Keys are managed on the API Keys page of your OnCore dashboard (view, generate, rotate). The same page also shows your client server secret, which is used to verify webhooks — it is not an API key.

Failed authentication#

Authentication failures use the standard error envelope:

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing or invalid Authorization header"
  },
  "metadata": {
    "timestamp": "2026-07-30T12:00:00.000Z",
    "version": "1.0",
    "path": "/assistants"
  }
}