Authentication

Every /v1 endpoint and the MCP server require a Pav API key, sent as a bearer token.

Authorization: Bearer <your_api_key>

The API Reference playground accepts the same key.

Create a key

Sign in at app.pav.bio.
Open Settings → Developer.
Create a key. Choose a personal key (tied to your user) or an organization key (tied to your organization).
Copy the secret. It is shown once and cannot be retrieved later.

Rotate and revoke

Create a new key, move your clients to it, then revoke the old key in Settings → Developer. Revocation takes effect within a few minutes.

Scopes

The API is read-only. Keys created without custom scopes work on every endpoint. A key created with custom scopes must include pav:pipeline:read; otherwise requests return 403 forbidden.

Authentication errors

Status	`code`	When
`401`	`unauthorized`	Missing, malformed, unknown, revoked or expired key. The response carries `WWW-Authenticate: Bearer`.
`403`	`forbidden`	The key declares scopes but not `pav:pipeline:read`.
`503`	`unavailable`	Key verification is temporarily unavailable. Retry with backoff; your key is not rejected.

Example 401 response

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key",
    "request_id": "77c9734bd1ed47d8bf126ebcf58dc393"
  }
}

See Rate limits and errors for the full error list.

Treat a key like a password. Keep it out of source control, logs and client-side code. Read it from an environment variable or a secret store.

Get started

Datasets

Working with the API

Integrations

Guides

Create a key

Rotate and revoke

Scopes

Authentication errors

​Create a key

​Rotate and revoke

​Scopes

​Authentication errors

Create a key

Rotate and revoke

Scopes

Authentication errors