Skip to main content
If you’re not building against the raw HTTP API directly, use the CLI instead — it handles authentication for you via slideless login.

​
The header

Every Slideless API endpoint (except the public token-based getSharedPresentation) authenticates via the standard bearer token header:

​
Key prefixes

The middleware inspects the prefix and routes to the right validator:
  • cka_ → validated against the admin_api_keys collection
  • cko_ → validated against the organization_api_keys collection (also resolves the org context)
Anything else returns 401.

​
Getting a key

Two paths:
  • Terminal / OTP (recommended for CI and agents) — POST /cliRequestSignupOtp then POST /cliCompleteSignup (or the login variants). No browser round-trip. See CLI auth endpoints or the CLI wrapper at cli/auth.
  • Dashboard — create a key at Organization → API Keys in app.slideless.ai. Same API keys concept either way; the OTP flow just automates the creation.
Pick scopes when creating: Keys minted through the OTP flow are granted both scopes by default.

​
Verifying a key

The CLI way:
The raw HTTP way:
200 → key is valid (response includes name, scopes, organization, last-used time). 401 → key is missing, malformed, or revoked.

​
Errors

​
What’s stored server-side

Slideless stores a SHA-256 hash of every API key, not the raw value. The dashboard shows the raw key once at creation. If you lose it, create a new one.

​
Operational guidance

  • Treat keys as secrets — don’t commit, paste, or log them.
  • One key per integration — easier to rotate, easier to attribute usage.
  • Set lastUsedAt reminders — long-unused keys are good revocation candidates.
  • Use slideless verify at the start of any long-running script so you fail fast on auth issues.