API Keys

API keys are Bearer tokens that authenticate your requests to the S6S API. Most /api/v1/* endpoints need one. The discovery endpoints do not: GET /api/v1/catalog, GET /api/v1/integrations, GET /api/v1/integrations/{id} and GET /api/v1/skill are open and only rate-limited.

A key acts as the account it belongs to — any workflow you deploy or run with it belongs to that account. A key can view, create, edit, deploy and run workflows. It cannot manage credentials, API keys, users or settings.

On s6s.ai: API keys and MCP access are issued by S6S on request. Customer accounts cannot create keys themselves. Contact us to ask for access.

On a self-hosted install: an admin creates keys (in the Community edition, editors can too):

1. Sign in to your S6S instance.
2. Open API Keys in the sidebar.
3. Click Create Key and give it a descriptive name (e.g. “production” or “ci-pipeline”).
4. Copy the key immediately. It starts with s6s_ and is only shown once.

Pass your API key as a Bearer token in the Authorization header. Here are examples for each integration method:

curl https://s6s.ai/api/v1/workflows \
  -H "Authorization: Bearer s6s_YOUR_API_KEY"

{
  "mcpServers": {
    "s6s": {
      "command": "npx",
      "args": ["@s6s/mcp-server"],
      "env": {
        "S6S_API_KEY": "s6s_YOUR_API_KEY",
        "S6S_BASE_URL": "https://s6s.ai"
      }
    }
  }
}

import { S6SClient } from "@s6s/sdk";

const client = new S6SClient({
  baseUrl: "https://s6s.ai",          // required: your S6S URL
  apiKey: process.env.S6S_API_KEY!,   // "s6s_YOUR_API_KEY"
});

const result = await client.deployWorkflow({
  name: "My Workflow",
  trigger: { type: "manual" },
  steps: [{ ref: "hello", action: "transform", config: { template: { msg: "hi" } } }],
  flow: ["hello"],
});

console.log(result.runId);

export S6S_API_KEY=s6s_YOUR_API_KEY

• Never commit keys to git. Add .env to your .gitignore and use environment variables in CI/CD.
• Use environment variables. Store your key in S6S_API_KEY rather than hardcoding it in source files.
• Rotate keys if compromised. If you suspect a key has been exposed, revoke it right away on the API Keys page and create a new one. On s6s.ai, ask S6S to revoke it.
• Each key acts as your account. Anyone with your key can deploy and run workflows as you. Treat it like a password.

The S6S API enforces rate limits to ensure fair usage and platform stability:

Writes are run, validate, cancel, retry, and updating or deleting a workflow. On a self-hosted install, S6S_DEPLOY_RATE_LIMIT and S6S_WEBHOOK_RATE_LIMIT change the first two limits.

When you exceed a rate limit, the API returns a 429 Too Many Requests response with a Retry-After header indicating how many seconds to wait before retrying.

HTTP/1.1 429 Too Many Requests
Retry-After: 12
Content-Type: application/json

{
  "error": "RATE_LIMIT_EXCEEDED",
  "retry_after_seconds": 12
}