Authentication

Every request authenticates with an API key in the Authorization header:

curl https://watchfor.io/api/v1/monitors \
  -H "Authorization: Bearer wf_live_YOUR_KEY"

Keys

Create keys in Settings → API keys (owners and admins only). Each key:

• belongs to one organization — it can only ever see that organization's data;
• has a scope: read (list/fetch) or write (also create, modify, acknowledge, resolve, delete);
• is stored hashed (SHA-256) — the full wf_live_… value is shown exactly once, at creation. If you lose it, revoke and create a new one;
• shows its last used time in the dashboard, so stale keys are easy to spot and revoke;
• can be revoked instantly — requests start failing with 401 the moment you click Revoke.

Every key creation and revocation is recorded in the organization activity log.

Handling keys safely

• Keep keys in environment variables or a secrets manager — never in source control or client-side code.
• Create one key per integration ("CI", "internal dashboard", "Grafana") so a leak is revocable without breaking everything else.
• Prefer read scope unless the integration genuinely mutates resources.
• Rotate by creating a new key, switching the integration, then revoking the old one — both stay valid during the switch, so there's no downtime.

Failure modes