---
title: "API overview and authentication"
description: "Use workspace-scoped bearer keys for the supported server-to-server API."
url: "https://documentation.verbatik.com/api/overview/"
---

# API overview and authentication

Use workspace-scoped bearer keys for the supported server-to-server API.

The server-to-server API uses this base URL:

```text
https://dashboard.verbatik.com/api/v1/workspaces/WORKSPACE_ID
```

## Create a key

Open **Settings → API keys** in the intended workspace. Choose a descriptive name, the minimum scopes, an expiry within the next year and a per-minute request limit. Save the full token securely when it is shown; the stored key list does not reveal it again.

Send it only from your server:

```bash
curl 'https://dashboard.verbatik.com/api/v1/workspaces/WORKSPACE_ID/agents' \
  -H "Authorization: Bearer $VERBATIK_API_KEY"
```

Tokens currently have the compatibility prefix `ca_live_`. Do not rename the token or place it in browser code, widget markup or URL query strings.

## Scopes

- `agents:read`, `agents:write`
- `calls:read`, `calls:write`
- `contacts:read`, `contacts:write`
- `campaigns:read`, `campaigns:write`
- `knowledge:read`, `knowledge:write`
- `billing:read`

Each key belongs to one workspace. The issuer must retain the corresponding active workspace permission. Revoking a key, expiring it or removing the issuer’s access prevents further use. Write permission is rechecked rather than assumed from the original key creation.

## Dashboard routes are separate

`/api/verbatik/WORKSPACE_ID/...` is the canonical namespace for dashboard session endpoints and specific public callbacks/widget routes. A bearer key does not turn every dashboard route into a public API. Do not automate internal integration, onboarding or settings routes using a copied browser session.

## Responses and limits

Success responses wrap results in `{ "data": ... }`. Errors use `{ "error": "message" }`; validation errors may also include `details`. Read responses are private and not cached.

The saved key limit is 1–600 requests per minute, default 60. A `429` response means wait for the next minute before retrying. Call capacity, carrier throughput and outbound policy limits are separate from API request limits.

See [Errors and retries](/api/errors), [Contacts](/api/contacts), [Agents](/api/agents), [Outbound calls](/api/outbound-calls) and [Webhooks](/api/webhooks).