Authentication

All API requests to Vastal require authentication using an API key.

API Keys

API keys are scoped tokens that grant access to specific operations. You can create multiple keys with different scopes for different use cases.

Creating an API Key

1. Go to Settings > Developer > API Keys
2. Click Create Key
3. Enter a descriptive name (e.g., "Production Integration")
4. Select the required scopes
5. Optionally set an expiration date
6. Click Create Key

API Key Scopes

Using Your API Key

Include your API key in the Authorization header of every request:

Authorization: Bearer vst_xxxxxxxxxxxxxxxxxxxxxxxx

Example Request

curl -X GET "https://api.vastal.com/v1/tables" \
  -H "Authorization: Bearer vst_xxxxxxxxxxxxxxxxxxxxxxxx"

Key Security Best Practices

1. Never expose keys in client-side code - API keys should only be used server-side
2. Use minimal scopes - Only request the permissions you need
3. Rotate keys regularly - Create new keys and revoke old ones periodically
4. Set expiration dates - For temporary integrations, use expiring keys
5. Monitor usage - Check the "Last Used" timestamp regularly

Revoking Keys

To revoke a compromised or unused key:

1. Go to Settings > Developer > API Keys
2. Find the key you want to revoke
3. Click the trash icon
4. Confirm the revocation

Warning: Revoking a key is immediate and cannot be undone. Any integrations using that key will stop working.

Rate Limits

API requests are rate-limited to ensure fair usage:

Rate limit headers are included in every response:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 999
X-RateLimit-Reset: 1640995200