Authentication
Authenticate to the Elnora API with an API key or OAuth.
Every Elnora API request is authenticated. The base URL is:
https://platform.elnora.ai/api/v1API keys (recommended for scripts & servers)
Create your first key in the dashboard under Settings → API keys. Once you have a key and the CLI is authenticated, you can mint more from the terminal:
elnora api-keys create --name ciSend it in the X-API-Key header on every request (or as
Authorization: Bearer <your-key> — both work):
curl https://platform.elnora.ai/api/v1/tasks \
-H "X-API-Key: $ELNORA_API_KEY"Keys are prefixed elnora_live_ and are shown in full only once, at creation.
A key inherits the roles of its creator and acts on the creator's organization.
It can read and write the data surfaces — tasks, messages, files, folders, the
library, and search — and on organization endpoints (members, invitations, keys)
it is bound by its creator's role, so an owner's key can invite a member and a
plain member's key cannot. A request a key may not make returns 403 with
errorCode: "INSUFFICIENT_SCOPE". Your organization can set a policy for who may
create keys — see the API keys reference.
Treat API keys like passwords. Store them in environment variables or a secrets
manager — never commit them. Revoke a key anytime from the dashboard or with
elnora api-keys revoke.
OAuth (interactive clients & MCP)
Interactive clients — including the MCP server — can authenticate with OAuth 2.1. The client opens a browser to authorize on first connect, then uses the issued bearer token automatically.
A token is re-checked against your current organization access on every request,
not just when it was issued. If that access ends — you leave the organization, or
it stops being active — requests return 403 with
errorCode: "ORGANIZATION_ACCESS_REVOKED", and the client has to authorize again
rather than retry.
Enterprise SSO
Enterprise organizations can enable single sign-on so members sign in through their own identity provider (OIDC or SAML). SSO is configured per organization and is typically invite-only — an admin sets it up, and members sign in with their work identity. Once signed in, you create and use API keys exactly as above.
Organizations
Most resources are scoped to an organization. Requests act on your active organization by default; many endpoints also accept an explicit organization id to target a specific org. See Core concepts.