Authentication and API keys

Bearer authentication

Send Authorization: Bearer sbs_pat_… on every REST and MCP request.

Create and scope

• Read: discovery, listings, catalog, search, your listings, your activity, and your asks. A read key cannot read messages.
• Read and write: listing drafts only. A key cannot publish a listing, send or read messages, or change bookings, reviews, reports, blocks, or your profile. Those stay on a signed-in session.

Store safely

Keep keys in an environment variable or secret manager. Never commit them or paste them into public repos.

export SANDBROCKSHARE_API_KEY="sbs_pat_…"

Rotate and revoke

Revoke a key in Settings and it stops on the next request. A key in its 7-day grace window still counts toward the 10-key cap, so rotation at the cap is refused until you revoke one. The replacement lasts 90 days.

Errors

• 401 KEY_REVOKED when a key is revoked or expired.
• 403 MEMBERSHIP_NOT_READY when the member still needs to finish joining in the app.