API keys are Bearer tokens scoped to your room.

The Authorization header

Authorization: Bearer wbl-…

• Requests without the header (or with anything other than a valid wbl- key) get 401 Unauthorized.
• Keys are shown in full exactly once, at creation. The stored form is a SHA-256 hash; a lost key cannot be recovered. Revoke it and mint a new one.

What a key is

• Room-scoped. A key is bound to the one room it was created in and can never act in another. If your account has several rooms, create one key per room.
• Read-only service identity. The key runs as its own principal inside the room: it reads what it needs to serve your requests (including conversation history) but cannot write tenant data.
• Not you. The key is not a member of the room and does not inherit any human's memberships or permissions. Spend bills to the room's normal funding sources.
• Individually limited. Rate limits and spend caps apply per key, so one integration cannot starve another.

Lifetime and rotation

• Keys expire after 90 days. The keys page shows each key's status and expiry.
• Revocation is instant. The next request with a revoked key gets 401 Unauthorized.
• Rotate on your schedule: create the replacement, deploy it, then revoke the old key. Both can be live at once during the window.
• Every key's last-used time is tracked and visible on the keys page, so stale integrations are easy to spot before they break.

Handling keys well

• Keep keys out of source control: load from an environment variable or secret manager (the examples here use $WEBEL_API_KEY).
• Use one key per integration or environment (dev / staging / prod). Per-key spend caps then bound the blast radius of any single leak.
• Name keys for their purpose ("staging-bot", "support-agent") so an audit of the keys page reads like an inventory.
• A leaked key cannot be scoped down after the fact: revoke it immediately and mint a replacement.

Terms

Accepting the Webel API Terms of Service (app.webel.ai/terms) is a one-time step, recorded per room and never asked again. Acceptance happens in the app (the "Accept API Terms" action) and is not re-checked per key. API calls themselves require nothing beyond the bearer header.

Note for browser testing: the wbl- bearer key only applies when there is no Webel session cookie on the request. If you're signed in to webel.ai in the same browser, the session cookie takes precedence and /v1 returns 401 even with a valid key. Test from a server or an incognito window.