API keys

An API key lets a script or an AI assistant act on your Apps as you. Every request to the Passion API and the Passion MCP needs one.

What a key is

• A key starts with psn_key_, for example psn_key_3fJk….
• A key reaches only the Apps you chose for it. A request about another App is refused, even when you own that App.
• A key is read or full. A read key can only read. A full key can also make changes, such as publishing a community post. See Scopes.
• No key can delete anything or move money.
• You see the key once, when it is created. Passion keeps only a hash of it, so nobody at Passion can show it to you again. If you lose it, get a new one.
• Passion records when the key was last used, and every change it made.

Get a key

Creating keys yourself in Passion Studio is coming soon.

Until then, ask Passion support for a key. Tell them:

1. a name for the key, for example “Claude Code on my laptop”;
2. the Apps the key must reach;
3. read or full access. Choose read unless the tool must make changes.

Send the key

Send the key in the Authorization header of every request:

Authorization: Bearer psn_key_…

For example:

curl https://api.passion.io/v1/apps/12345/overview \
  -H "Authorization: Bearer psn_key_…"

A request with no key, an unknown key or a revoked key gets 401 with the code unknown_key. See Errors.

Keep the key safe

• Treat the key like a password. Do not put it in a file that you share or commit.
• Use a different key for each tool, so you can stop one tool without stopping the others.
• If a key leaks, ask Passion support to revoke it. A revoked key stops working on the next request.