API reference

Authenticate from your server with a Bearer key.

The browser should never call HarnessRouter directly with the Workspace API key.

Server-only rule

  • Use the key from backend code only.
  • Return product-shaped responses to the browser.
  • Proxy file previews and downloads through authenticated product routes.
  • Do not forward caller-controlled org, member, Workspace, or harness IDs without server-side validation.
Open standard

This page's server-only Bearer rule is the client-side counterpart of UHP's credential requirements, which forbid a credential from ever appearing in a response body, event, log line, or artifact. See credential rules in UHP's Security chapter.

Create API Key

Ready to run this against a live workspace? Keys take under a minute.