Skip to main content

​
The header

Every Slideless API endpoint (except the public token-based getSharedPresentation) requires a single header: 
X-Process-Manager-Key: cko_your_key_here
This is not Authorization: Bearer …. The Slideless backend only checks X-Process-Manager-Key.

​
Key prefixes

PrefixTypeUse case
cko_Organization keyWhat every external integration uses
cka_Admin keyInternal platform automation; not user-creatable
The middleware inspects the prefix and routes to the right validator:
  • cka_ → validated against the admin_api_keys collection
  • cko_ → validated against the organization_api_keys collection (also resolves the org context)
Anything else returns 401.

​
Getting a key

See Quickstart Step 2 and the API keys concept — keys are created in the dashboard at Organization → API Keys. Pick scopes when creating:
ScopeGranted to
presentations:writeEndpoints that create or modify presentations (upload, update)
presentations:readEndpoints that read presentations (list, get)
Scope enforcement is intent-based in v1: pick the scope that matches your use case; future versions will reject calls that mismatch.

​
Verifying a key

Use POST /verifyApiKey to check a key without making a destructive call: 
curl -X POST \
  -H "X-Process-Manager-Key: cko_..." \
  https://europe-west1-slideless-ai.cloudfunctions.net/verifyApiKey
200 → key is valid (response includes name, scopes, organization, last-used time). 401 → key is missing, malformed, or revoked.

​
Errors

StatusCodeWhat it meansFix
401unauthenticatedHeader missing or key not recognizedSend X-Process-Manager-Key with a valid cko_ or cka_ value
403permission-deniedKey valid but you don’t own the resourceThe key’s user must match the presentation’s ownerId
403revokedKey was revokedCreate a new key

​
What’s stored server-side

Slideless stores a SHA-256 hash of every API key, not the raw value. The dashboard shows the raw key once at creation. If you lose it, create a new one.

​
Operational guidance

  • Treat keys as secrets — don’t commit, paste, or log them.
  • One key per integration — easier to rotate, easier to attribute usage.
  • Set lastUsedAt reminders — long-unused keys are good revocation candidates.
  • Use verifyApiKey at the start of any long-running script so you fail fast on auth issues.