Get started

Authentication

Every /api/v1/* request must include a Bearer API key. The key authenticates as your wallet address — the sender of any envelopes you submit.

Header

Send the secret exactly as issued. Most routes use a personal API key (prefix sk_live_). Group bot routes also accept a creator-issued gtk_live_… token — see Groups.

http

Authorization: Bearer sk_live_…
Authorization: Bearer gtk_live_…

Create a key

Keys are created inside the sealed app after purchasing Developer API access (one-time on-chain unlock). Open Settings → Paid Features → Developer API keys. The full secret is returned once; we store only a hash.

Environment variable

bash

export SEALED_API_KEY="sk_live_…"

curl https://api.sealedlabs.net/api/v1/handles/alice \
  -H "Authorization: Bearer $SEALED_API_KEY"

Revoked or missing keys receive 401 with { "error": "Invalid or missing API key" }. Bare secrets without the Bearer scheme are rejected.

Never embed API keys in public frontend bundles. Prefer a server you control, or the in-docs Try-it panels (sessionStorage only) for manual testing.