Authentication

Authenticate every request with a Genaya API key.

Send your key as a bearer token in the Authorization header:

HTTP

Authorization: Bearer gny_live_xxx

Live vs test keys

gny_live_... - production traffic.
gny_test_... - operates on the SAME organization data but is flagged so you can separate test traffic. There is no isolated sandbox dataset in v1.

A missing, malformed, or revoked key returns 401 authentication_error. A key whose organization is on a plan without API access returns 403 permission_error with code plan_required (the API needs the Individual plan or above). On a free trial only test keys exist: a live key returns 403 permission_error with code live_key_requires_paid_plan, and a test key on any write returns 403 permission_error with code test_mode_read_only. An organization that switched the Developer API off under Settings > Features returns 403 permission_error with code feature_disabled.

Scopes

Each key carries optional per-resource scopes, for example appointments:read or invoices:write. A key with no scopes has full access. When scopes are present, a request that needs a scope the key lacks returns 403 permission_error with code insufficient_scope.

warningAPI keys are server-to-server credentials. Never embed them in browser or mobile apps.