Authentication

Souma has two separate access paths:

1. Interactive product access through the homepage drawer
2. Programmatic API access through API keys

Interactive access

• Create New Workspace provisions a new team environment
• Login gets existing users back into the dashboard
• verified users land in the dashboard and can then create API keys

API keys

Generate API keys from **Dashboard > Integration > API Keys** or visit your Souma Dashboard.

Available scopes

Using your key

Include your API key in the Authorization header of every request:

curl -H "Authorization: Bearer sk_live_xxxxxxxxxxxxx" \
  http://localhost:3000/api/validate

Client versus server usage

• Server-side use API keys directly
• Dashboard client code can use Souma's authenticated fetch helpers and session state
• do not expose raw production keys in browser bundles

Key rotation

We recommend rotating your API keys periodically:

1. Generate a new key from the dashboard
2. Update your environment variables
3. Verify the new key works
4. Revoke the old key

Security best practices

• Store API keys in environment variables, never in source code
• Rotate keys regularly and after any potential exposure
• Use the principle of least privilege when creating keys
• Keep separate keys per environment or service
• Revoke old keys immediately after migration