Skip to main content
Most Plato APIs use API keys created in Console. Create keys from Console API Keys. Use a dedicated key per integration so it can be rotated or removed without affecting other tools.

​
Preferred Header

For most API requests, send the key as a Bearer token:
Example:

​
Alternative Header

Some integrations use x-api-key:
Example:

​
Query Parameter

Older REST endpoints also accept apiKey in the query string:
Use headers for new server-side integrations. Query strings can appear in logs, browser history, analytics tools, and shared URLs. Keep PLATO_API_KEY on the server. Do not expose it in browser JavaScript or mobile apps.

​
Session Authentication

The profile endpoint uses the signed-in user session instead of an API key. Use session-based endpoints only when the request is being made for a signed-in user. API-key integrations should use the API-key routes documented in this section.

​
Key Safety

  • Store API keys in environment variables or a secret manager.
  • Do not paste keys into public code, screenshots, support tickets, or docs.
  • Rotate keys when a tool owner changes.
  • Delete keys that are no longer used.
  • Give each key the smallest role that still lets the integration work.