Bearer keys, room-scoped.

The Authorization header

Authorization: Bearer wbl-…

• Requests without the header — or with anything other than a valid wbl- key — get 401 Unauthorized.
• Keys are shown in full exactly once, at creation. The stored form is a SHA-256 hash; a lost key cannot be recovered. Revoke it and mint a new one.

What a key is

• Room-scoped. A key is bound to the one room it was created in and can never act in another. If your account has several rooms, create one key per room.
• Read-only service identity. The key runs as its own principal inside the room: it reads what it needs to serve your requests (including conversation history) but cannot write tenant data.
• Not you. The key is not a member of the room and does not inherit any human's memberships or permissions. Spend bills to the room's normal funding sources.
• Individually limited. Rate limits and spend caps apply per key, so one integration cannot starve another.

Lifetime and rotation

• Keys expire after 90 days. The keys page shows each key's status and expiry.
• Revocation is instant — the next request with a revoked key gets 401 Unauthorized.
• Rotate on your schedule: create the replacement, deploy it, then revoke the old key. Both can be live at once during the window.
• Every key's last-used time is tracked and visible on the keys page, so stale integrations are easy to spot before they break.

Handling keys well

• Keep keys out of source control — load from an environment variable or secret manager (the examples here use $WEBEL_API_KEY).
• Use one key per integration or environment (dev / staging / prod). Per-key spend caps then bound the blast radius of any single leak.
• Name keys for their purpose ("staging-bot", "support-agent") so an audit of the keys page reads like an inventory.
• A leaked key cannot be scoped down after the fact: revoke it immediately and mint a replacement.

Terms

Creating the first key in a room requires accepting the Webel API Terms of Service (webel.ai/terms). Acceptance happens in the app at key creation, is recorded per room, and is never asked again. API calls themselves require nothing beyond the bearer header.