Skip to main content

Authentication

The Treeship API uses Bearer token authentication. You need an API key to create attestations.

Getting an API Key

Step 1: Request Verification Code

curl -X POST https://api.treeship.dev/v1/keys/request \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'
Response:
{
  "message": "Verification code sent to you@example.com",
  "expires_in": 600
}

Step 2: Verify and Get Key

Check your email for the 6-digit code, then:
curl -X POST https://api.treeship.dev/v1/keys/verify \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "code": "123456"}'
Response:
{
  "api_key": "ts_live_a1b2c3d4e5f6...",
  "key_id": "key_abc123",
  "created_at": "2026-02-23T10:00:00Z"
}
Save your API key immediately. It’s only shown once.

Using Your Key

Include the API key in the Authorization header:
curl -X POST https://api.treeship.dev/v1/attest \
  -H "Authorization: Bearer ts_live_..." \
  -H "Content-Type: application/json" \
  -d '{"agent_slug": "my-agent", "action": "...", "inputs_hash": "..."}'

Python SDK

from treeship_sdk import Treeship

# From environment variable (recommended)
ts = Treeship()  # reads TREESHIP_API_KEY

# Or explicit
ts = Treeship(api_key="ts_live_...")

CLI

# Environment variable
export TREESHIP_API_KEY=ts_live_...
treeship attest --action "..." --inputs-hash "..."

# Or configure once
treeship config set api-key ts_live_...

Key Management

Check Key Info

curl https://api.treeship.dev/v1/keys/info \
  -H "Authorization: Bearer $TREESHIP_API_KEY"
Response:
{
  "key_id": "key_abc123",
  "email": "you@example.com",
  "created_at": "2026-02-23T10:00:00Z",
  "attestations_today": 42,
  "rate_limit": 1000
}

Revoke Key

curl -X DELETE https://api.treeship.dev/v1/keys \
  -H "Authorization: Bearer $TREESHIP_API_KEY"

Rate Limits

TierAttestations/DayAttestations/Minute
Free1,000100
Rate limit headers are included in responses:
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 958
X-RateLimit-Reset: 1640995200

Error Responses

StatusCodeMeaning
401unauthorizedMissing or invalid API key
403forbiddenKey revoked or rate limited
429rate_limitedToo many requests
{
  "detail": "Invalid API key"
}

Best Practices

Use Environment Variables

Never hardcode keys. Use TREESHIP_API_KEY.

Rotate Keys

Generate new keys periodically.

Separate Environments

Different keys for dev, staging, prod.

Monitor Usage

Check /keys/info regularly.