Authentication

The exit1.dev API accepts two kinds of credential:

API keys, sent in the X-Api-Key header. Covered on this page.
Bearer tokens, sent as Authorization: Bearer <token>. An AI agent gets one by signing its user up with POST https://app.exit1.dev/oauth/agent-signup. Bearer tokens work on every endpoint an API key works on.

AI agent with no exit1 credentials? You don’t need the user to create a key. See Agent Signup.

API Keys

Creating a Key

Navigate to Settings > API
Click Create API Key
Select the scopes you need (read, write, delete)
Optionally pick an expiry and restrict the key to some checks or folders
Copy the generated key immediately (it won’t be shown again)

How many keys you can hold depends on your plan. Every plan can mint at least one. API and MCP access are the same entitlement, and neither is paid-only.

Plan	API keys
Free	1
Indie	3
Nano	10
Pro	100

Key Format

API keys follow the format:


ek_live_<64 hex characters>

Example:


ek_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2

Using the Key

Include your API key in the X-Api-Key header with every request:


curl -H "X-Api-Key: ek_live_your_key_here" \
  https://us-central1-exit1-dev.cloudfunctions.net/publicApi/v1/public/checks

Scopes

API keys support three scopes that control what operations the key can perform:

checks:read - Read checks, history, and stats (default)
checks:write - Create, update, and toggle checks
checks:delete - Delete checks

Keys created without specifying scopes default to read-only. See the Scopes page for details.

Expiry

A key can be created with an expiry: 1 hour, 8 hours, 24 hours, 7 days, 30 days or 90 days. Keys without one never expire. A short expiry suits a key you hand to an AI tool or a one-off script.

Once a key expires, every request with it returns 401 with {"error": "API key expired"}. The API Keys page shows the expiry time and marks expired keys. An expired key can’t be renewed: create a new one.

Restricting a Key to Checks or Folders

By default a key sees every check on the account. When creating a key you can instead choose Only selected checks and folders and pick:

Checks: the key can use exactly these checks.
Folders: the key can use every check in the folder and its subfolders, including checks added to them later.

A restricted key behaves as if the other checks don’t exist:

Endpoint	Behavior for a restricted key
`GET /v1/public/checks`	Lists only the allowed checks (`total` counts only those)
`GET /v1/public/checks/status`	Returns only the allowed checks
`GET`, `PATCH`, `DELETE /v1/public/checks/{id}` and every `/checks/{id}/...` route	`404` with `{"error": "Check not found"}` for any check outside the grant
`POST /v1/public/checks`	Only into an allowed folder: pass `folder`, for example `"Clients/Acme"` or `"Clients/Acme/Staging"`. A key restricted only to individual checks can’t create checks. Otherwise `403`
`/v1/public/alerts/...`	`403`. Alert channels are account-wide, so they need an unrestricted key

Restrictions combine with scopes: scopes decide what a key may do, the restriction decides which checks it may do it to. GET /v1/public/account returns the calling key’s expiresAt and access under key.

Expiry and restrictions are set when the key is created and can’t be changed later. OAuth access tokens used by MCP clients are not affected by either.

Revoking a Key

To revoke an API key:

Navigate to Settings > API
Click Revoke next to the key
Confirm the revocation

Revoked keys are immediately invalidated. Any requests using a revoked key will receive a 401 Unauthorized response.

Security Best Practices

Never expose API keys in client-side code or public repositories
Use environment variables to store API keys
Rotate keys periodically
Revoke unused keys immediately
Each key has independent rate limits
Only grant the scopes your integration actually needs
Give keys for AI tools and scripts a short expiry and restrict them to the checks they work on