Authentication

All API requests require authentication using an API key.

Getting an API Key

1. Log in to Sidvy
2. Go to Settings > API Keys
3. Click Generate New Key
4. Copy the key (shown only once)

See API Keys for detailed instructions.

Using Your API Key

Include the API key in the Authorization header of every request:

curl -X GET "https://sidvy.com/api/note" \
  -H "Authorization: Bearer sidvy_abc123..."

API Key Format

API keys follow this format:

• Prefix: sidvy_
• Random string: 32+ characters

Example: sidvy_a1b2c3d4e5f6g7h8i9j0...

Base URL

All API requests use this base URL:

https://sidvy.com/api

Content Type

All requests with a body must include the JSON content type header:

Content-Type: application/json

Response Format

All successful responses follow this structure:

{
  "data": { ... },
  "pagination": {
    "page": 1,
    "limit": 50,
    "total": 100,
    "totalPages": 2
  },
  "count": 100
}

For single-item responses, data contains the object directly. For lists, data is an array.

Error Responses

All errors follow this structure:

{
  "error": "ERROR_CODE",
  "message": "Human-readable error message"
}

Common Error Codes

Code	HTTP Status	Description
UNAUTHORIZED	401	Missing or invalid API key
FORBIDDEN	403	Access denied to resource
NOT_FOUND	404	Resource not found
VALIDATION_ERROR	400	Invalid request parameters
MALFORMED_REQUEST	400	Invalid JSON in request body
INTERNAL_ERROR	500	Server error

Authentication Errors

401 Unauthorized

{
  "error": "UNAUTHORIZED",
  "message": "Authentication required"
}

Causes:

• Missing Authorization header
• Invalid API key format
• Revoked API key

403 Forbidden

{
  "error": "FORBIDDEN",
  "message": "Access denied to workspace"
}

Causes:

• Attempting to access another user’s data
• Resource belongs to different user

Security Best Practices

Keep Keys Secret

• Never commit API keys to version control
• Use environment variables
• Don’t expose keys in client-side code

Use HTTPS

All API requests must use HTTPS. HTTP requests are rejected.

Rotate Keys Periodically

Create new keys and revoke old ones regularly, especially if team members leave.

Monitor Usage

Check Settings > API Keys for last-used timestamps to detect unauthorized access.