Get an API Key
Every request to the Sail API must include an API key in the Authorization header. This page explains how to get your keys,how scopes work, and how to use keys in your requests.
Request API keys
Reach out to the Sail technical team through your dedicated Slack channel to request API keys.
Base URL
All API requests use the following base URL:
https://live.savewithsail.com/api/v1Authenticate your request
Include your API key as a Bearer token in the Authorization header on every request.
curl -X GET https://live.savewithsail.com/api/v1/users \
-H "Authorization: Bearer sk_live_..."Key scopes
Key scopes
Each API key has a fixed set of scopes that control which endpoints it can access. You use the same key on every request, and Sail checks whether that key’s scopes cover the endpoint you’re calling. If not, the API returns 403 insufficient_key_scope.
The Sail team will work with you during implementation to determine the right scopes for your keys. You can request multiple keys with different scopes so that each part of your system only has access to what it needs.
| Scope | Description |
|---|---|
expenses | Read expense data and create related connections (cards, merchants). |
benefit_account | Create HSA/FSA connections and read account data (balances, activity, contributions). |
account_numbers | Access ACH deposit account and routing numbers. |
identity | Access personal information (PII) for users and account owners. |
ingest | Push your own transaction data to a connection for classification. |
token_admin | Create and revoke short-lived tokens needed to access PII endpoints. |
token_admin is exclusive**
A key with the token_admin scope cannot hold any other scope. This is enforced at key creation. The minting key can create tokens but can’t use them to access data. A separate workload key presents the token to PII endpoints. This ensures that reaching PII always needs two credentials from two deployment contexts.
Scope recommendations by integration path
The scopes you need depend on which integration path you’re following.
| Integration path | Scopes |
|---|---|
| Expenses | expenses |
| Classification | expenses, ingest |
| Account connection | benefit_account, account_numbers, identity |
If you’re using PII endpoints (identity, account_numbers), you also need a separate key with the token_admin scope to mint ephemeral user tokens. See Authentication for more on ephemeral tokens.
Next steps
- See Create a user to create your first user.