Read keys

Authentication

Every request goes to https://app.squally.dev/api/v1 plus the path and carries an organization read key as Authorization: Bearer sqly_ro_…. With the key in SQUALLY_API_KEY - the variable the MCP server reads too - the first request lists the organization’s projects:

curl -H "Authorization: Bearer $SQUALLY_API_KEY" https://app.squally.dev/api/v1/projects

A read key is organization-wide (every project), created by an organization admin in Organization › Read keys, and expires after 30, 60, 90, 180 days as chosen at creation. There is no renewal: create a new key and revoke the old one. Project ingest keys (sqly_…) are refused with wrong_key_type.

Expiry warning

From 7 days before a key expires, every authenticated response carries Squally-Key-Expires-At with the expiry instant (ISO-8601). Once it has passed, every request with the key is answered 401 key_expired (“This read key expired on . Create a new one in Organization › Read keys.”); an expired key is never extended. To rotate without a gap: create a new key, switch your callers to it, then revoke the old one - an organization may hold several active keys, and each works until it expires or is revoked.

Plans

The read API is part of the Standard and Pro plans. A key of an organization on Free is answered 403 tier_too_low; keys are not revoked on a downgrade and work again after an upgrade.