API keys

Create keys in Developer settings. Give each key a name that identifies its consumer and choose an expiry of 7, 30 or 90 days, or no automatic expiry.

The secret begins with st_live_ and is shown once. Trace stores a one-way hash, so a lost key cannot be recovered; revoke it and create another.

Authenticate a request

Send the secret in the Authorization header:

Authorization: Bearer st_live_••••••••

Never put a key in a URL, browser bundle, source repository or webhook payload. Load it from your server's secret store at runtime.

1curl \
2  --request GET \
3  --url "https://accounts.sterlingtrace.com/developer/v1/memories/7b4f5c42-7f27-4f38-9f53-524b7e574d51" \
4  --header "Authorization: Bearer $TRACE_API_KEY"

1const response = await fetch(
2  "https://accounts.sterlingtrace.com/developer/v1/memories/7b4f5c42-7f27-4f38-9f53-524b7e574d51",
3  {
4    headers: {
5      Authorization: `Bearer ${process.env.TRACE_API_KEY}`,
6    },
7  },
8);
9
10if (!response.ok) throw new Error(`Trace returned ${response.status}`);
11const { memory } = await response.json();

1import os
2import requests
3
4response = requests.get(
5    "https://accounts.sterlingtrace.com/developer/v1/memories/7b4f5c42-7f27-4f38-9f53-524b7e574d51",
6    headers={"Authorization": f"Bearer {os.environ['TRACE_API_KEY']}"},
7    timeout=10,
8)
9response.raise_for_status()
10memory = response.json()["memory"]

Scope and ownership

Newly created keys have memories:read and memories:write by default. In Developer settings, edit any existing key to grant or remove permissions without replacing its secret. memories:read permits retrieving a Memory; memories:write permits adding an Apple Note revision. A key can access only Memories owned by the Sterling Trace account that created it. Cross-account IDs return the same 404 shape as missing Memories.

Rotation

Create the replacement, update the consumer, verify one successful request, then revoke the old key. Expired and revoked keys return 401 { "error": { "code": "not-authenticated" } }.