For the complete documentation index, see llms.txt. This page is also available as Markdown.

Authentication

Every request carries a secret API key as a bearer token over HTTPS. Requests without a valid key return 401 with error.type: authentication_error.

Text
Authorization: Bearer sk_live_7f3a91c04d8e2b6a5c1f SciSpace-Version: 2026-08-01

One kind of key: secret, server-side

Livesk_live_… — billed against your organization's credits
Testsk_test_… — 500 free credits a month, see environments

There is no publishable or browser-safe key. Every endpoint is metered and returns licensed scholarly content, so all calls must originate from your backend.

Never ship a key to a client

A key in a browser bundle, mobile binary, or public repository can drain your entire credit balance. Proxy API calls through your own server and apply your own per-user limits.

Scopes

Keys are scoped. A call outside a key's scopes returns 403 permission_error — it does not silently degrade. Full list in teams-and-scopes; a new key defaults to full access minus webhooks:write and usage:read.

Verifying a key

cURL
curl https://api.scispace.com/v1/usage \ -H "Authorization: Bearer $SCISPACE_API_KEY"

200 means the key is live and has usage:read. 401 means the key is wrong or revoked; 403 means it is valid but unscoped for that call.

Related

api-keys · environments · teams-and-scopes · errors-and-retries

Last updated