Authentication
The API authenticates requests with a bearer token in the Authorization header:
Authorization: Bearer srk_live_5f3a1c...There is no OAuth flow today — a token is a long-lived credential you generate directly in the app and pass with every request. OAuth 2.1 (for third-party and agent integrations that shouldn’t share a static token) is designed and roadmapped, not yet built — this page will be updated when that ships.
Live vs. test tokens
Section titled “Live vs. test tokens”Every token is prefixed by its environment:
srk_live_...— acts on real data in your workspace.srk_test_...— intended for testing. At present this is a naming convention only; test tokens run against the same database as live tokens, so treat test-prefixed credentials with the same care as live ones until sandboxed test environments ship.
Scopes
Section titled “Scopes”Tokens are created with a specific set of scopes — string permissions like surveys:read, surveys:write, distribution:write, or contacts:suppress — rather than blanket account access. A request fails with insufficient_scope (see Errors) if the token’s scopes don’t cover the action being called.
Some representative scopes:
| Scope | Grants |
|---|---|
surveys:read / surveys:write |
Survey CRUD, settings, elements |
responses:read / responses:write |
Read responses/aggregates; submit responses |
distribution:read / distribution:write |
Distributors — web links, QR codes, embeds |
contacts:read / contacts:write |
Contact CRUD, import |
contacts:suppress |
Unsubscribe/suppression — kept separate from contacts:write since it’s consent-sensitive |
reports:export |
Generate and download response exports |
Grant only the scopes an integration actually needs. The full, current scope list is visible when creating a token in the app. Token management itself (creating, rotating, revoking) isn’t part of the API — it’s app-only, from Settings → API Tokens; see Rotating and revoking tokens below.
Tenancy
Section titled “Tenancy”Every token is bound to a single account and workspace. Requests are always scoped to that workspace — there’s no way for a token to read or write data belonging to a different workspace, including another workspace you personally belong to. Use a separate token per workspace if you’re integrating with more than one.
Rotating and revoking tokens
Section titled “Rotating and revoking tokens”Tokens can be rotated or revoked from Settings → API Tokens in the app at any time, with immediate effect. There’s no grace period on revocation — a revoked token starts failing authentication on its very next request.