Pharen API Authentication: API Keys and Bearer Tokens

Every request you make to the Pharen API must be authenticated. Send a scoped API key as a Bearer token in the Authorization header. Without a valid key, the API returns 401 Unauthorized and does not process the request.

Generate an API key

You manage your API keys from inside the Pharen Hub dashboard:

Sign in to pharen.app.
Navigate to Settings → API Keys in the left sidebar.
Click New API Key.
Give your key a descriptive name (e.g., ci-pipeline or data-export-script).
Choose an access target and scopes.
Copy the key immediately — it is only shown once in full at creation time.

Treat your API key like a password. Anyone who holds it can make API calls on behalf of your workspace. Do not commit keys to source control, log them, or expose them in client-side code. Use environment variables or a secrets manager instead.

For a full walkthrough of key scopes, team targets, rotation, and storage, see API keys.

Use your API key

Pass your API key as a Bearer token in the Authorization header of every HTTP request:

Authorization: Bearer YOUR_API_KEY

The examples below call the calendar events endpoint. You can also use the interactive playground on each endpoint page.

curl https://pharen.app/api/calendar/events/ \
  --request GET \
  --header "Authorization: Bearer YOUR_API_KEY" \
  --header "Content-Type: application/json"

const response = await fetch("https://pharen.app/api/calendar/events/", {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${process.env.PHAREN_API_KEY}`,
    "Content-Type": "application/json",
  },
});

if (!response.ok) {
  const error = await response.json();
  throw new Error(error.error.message);
}

const data = await response.json();
console.log(data);

import os
import requests

headers = {
    "Authorization": f"Bearer {os.environ['PHAREN_API_KEY']}",
    "Content-Type": "application/json",
}

response = requests.get(
    "https://pharen.app/api/calendar/events/",
    headers=headers,
)
response.raise_for_status()

data = response.json()
print(data)

If your HTTP client cannot set a Bearer token, send the same key through X-API-Key:

X-API-Key: YOUR_API_KEY

In the examples above, the API key is read from an environment variable (PHAREN_API_KEY). This is the recommended approach — it keeps secrets out of your codebase and makes rotating keys straightforward.

Authentication Errors

If your request cannot be authenticated, the API responds with one of the following errors:

Status	Code	Cause
`401 Unauthorized`	`missing_token`	No `Authorization` header was present in the request.
`401 Unauthorized`	`invalid_token`	The token provided is malformed, expired, or does not exist.
`403 Forbidden`	`insufficient_permissions`	The key is valid but lacks permission to access this resource or perform this action.

An error response looks like this:

{
  "error": {
    "code": "invalid_token",
    "message": "The API key provided is invalid or has been revoked."
  }
}

Revoking a Key

If a key is compromised or no longer needed, revoke it immediately from Settings → API Keys in the dashboard. Revoked keys stop working instantly. You can generate a replacement key at any time without disrupting other keys.

Rotating keys periodically is a good security practice, even if you have no reason to suspect a compromise. Consider setting a reminder to rotate production keys every 90 days.

Key scopes and permissions

API keys combine explicit key scopes with the permissions of the workspace member who created them. If that member’s role is changed or their account is deactivated, all keys they created reflect the updated permissions or stop working. For production integrations, create keys under a dedicated service account with only the scopes your integration requires. See the API keys scope reference for the full list.

Overview

Calendar

Lists

Docs

Workflows

Agents

Pharen API Authentication: API Keys and Bearer Tokens

Generate an API key

Use your API key

Authentication Errors

Revoking a Key

Key scopes and permissions

​Generate an API key

​Use your API key

​Authentication Errors

​Revoking a Key

​Key scopes and permissions

Generate an API key

Use your API key

Authentication Errors

Revoking a Key

Key scopes and permissions