Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.phrony.com/llms.txt

Use this file to discover all available pages before exploring further.

Authentication is header-based: you send a workspace API key on every authenticated route. There is no separate OAuth or session cookie for the public JSON API.

​
API keys

Create and revoke keys in the Phrony dashboard (workspace or Settings, depending on layout). Each key is a single secret; issued keys are prefixed with phk_. Do not commit keys to source control or put them in client-side code; use environment variables or a secret manager on your server.

​
Headers (authenticated routes)

HeaderRequiredValue
X-API-KeyYes for authenticated routesYour workspace API key (prefix phk_).
Content-TypeWhen sending a JSON bodyapplication/json
Example: 
X-API-Key: <your key>
Content-Type: application/json
The gateway allows X-API-Key in CORS preflight.

​
Example

Every authenticated request adds the same header. Replace RUN_ID after you start a run. 
export PHRONY_API_BASE="${PHRONY_API_BASE:-https://api.phrony.com}"
export PHRONY_API_KEY="phk_..."

curl -sS "${PHRONY_API_BASE}/v1/runs/00000000-0000-0000-0000-000000000001" \
  -H "X-API-Key: ${PHRONY_API_KEY}"

​
Scoping

Keys are scoped to your workspace and to specific agent and API trigger pairs (and optionally other constraints). The scope determines what you may call:
Your callWhat Phrony checks
POST /v1/agents/{agentId}/runsThe key must be scoped to that agentId and the API trigger used to start the run. The path agentId must match.
GET /v1/agents/{agentId}/sessionsSame as above: agentId in the path must match the key’s agent scope.
GET / POST under /v1/runs/{runId}/…The key must be an active key for the workspace, and the key must be allowed to access that run (same agent, and when the run is tied to a trigger, a scope that includes that trigger).
POST /v1/file-library/presign and …/finalizeThe key must have file uploads enabled.
If a key is missing, wrong, or out of scope, the API returns 401 (missing or invalid key) or 403 (forbidden) as appropriate.

​
File uploads

POST to /v1/file-library/* returns 403 if Allow file uploads is not enabled for that key, even when the key is otherwise valid. See File library for the upload flow.