Authentication

Every /api/v1 request requires an API key generated by an organization owner or admin.

Send the key

Use the x-api-key header for every request.

curl "https://trainertwin.com/api/v1/sessions" \
  --header "x-api-key: $TRAINERTWIN_API_KEY"

TrainerTwin also accepts a bearer token for platforms that cannot configure a custom header.

curl "https://trainertwin.com/api/v1/sessions" \
  --header "Authorization: Bearer $TRAINERTWIN_API_KEY"

Prefer x-api-key. Send only one authentication header per request.

Property	Behavior
Ownership	One organization
Permissions	Read and write users, sessions, and assignments
Expiration	One year after generation
Rate limit	120 requests per minute, per key
Storage	Hashed; the full key cannot be recovered

The organization is derived from the key. Requests cannot supply or override an organization ID.

Generate a replacement

Update your platform

Replace the stored secret and confirm a request succeeds with the new key.

Revoke the old key

Return to the Developer API page and revoke the previous key.

Revocation takes effect immediately.

{
  "error": "Invalid API key"
}

See Errors for the complete error model.