Authentication & access
Authenticate REST API requests with an API key in the Authorization header:
Authorization: Bearer gsc_...Create an API key
Section titled “Create an API key”The account owner or an admin creates API keys in the Getsitecontrol admin, under API keys. A key belongs to the account, not to a person, and keeps working when the person who created it leaves.
When you create a key, give it a name and choose its access for each site: a level (none, view, edit or full) for widgets, emails and contacts. Give each integration its own key with only the access it needs.
The secret is shown once, when the key is created. Store it in a secret manager or an environment variable, and keep it out of source control, shared examples and AI conversations.
Send the key
Section titled “Send the key”curl --fail-with-body \ https://api.getsitecontrol.com/v1/sites \ -H "Authorization: Bearer $GSC_API_KEY"A request without a key is 401 unauthenticated. A key that is unknown or revoked is 401 invalid_token. A key without the access the operation needs is 403 forbidden; metadata.permission in the error names the permission it needs.
Revoke a key
Section titled “Revoke a key”Keys created in the admin do not expire. Revoke a key in the admin, under API keys; it stops working immediately. Revoke and replace a key that may have leaked.
Tokens of connected apps
Section titled “Tokens of connected apps”An app connected to your account through OAuth, such as an AI assistant, gets an access token (gscu_...) and sends it the same way, as Authorization: Bearer. A token acts as the user who connected the app, with that user’s current permissions. The user disconnects the app under Connected apps in their profile; changing the password or blocking the user also stops the token.