Authentication

Every call sends a SECSift API key in the Authorization header. Keys come from the "API keys" dialog in the reader, and the API answers keys from Analyst and Pro accounts.

Send the key

Put the key after Bearer in the Authorization header:

Authorization: Bearer sk_secsift_...

Here's the same call in curl, Python, and JavaScript, each reading the key from SECSIFT_KEY. In curl:

curl "https://api.secsift.com/v1/companies/AAPL" \
  -H "Authorization: Bearer $SECSIFT_KEY"

In Python, with the requests library:

import os
import requests

r = requests.get(
    "https://api.secsift.com/v1/companies/AAPL",
    headers={"Authorization": f"Bearer {os.environ['SECSIFT_KEY']}"},
)
print(r.json())

In JavaScript, with fetch:

const r = await fetch('https://api.secsift.com/v1/companies/AAPL', {
  headers: { Authorization: `Bearer ${process.env.SECSIFT_KEY}` }
});
console.log(await r.json());

Keys

Here's how keys work:

• Where: Create and revoke keys under "API keys" in the reader's account menu, at the bottom of the left sidebar. SECSift shows each key only once, when you create the key.
• How many: An account can have 5 keys at a time, shared with the MCP server and the SECSift Excel add-in. All of an account's keys share one daily allowance.
• Format: A key is sk_secsift_ followed by 40 letters, digits, dashes, and underscores.
• Plans: Any account can create a key, but the API answers only keys from Analyst and Pro accounts. A plan change reaches the API within 10 minutes.
• Revoking: A revoked key stops working on its next call.

Errors

A problem with the key answers one of two errors:

A missing or malformed header answers this body:

{
  "error": {
    "type": "authentication",
    "message": "Send your SECSift API key in the Authorization header as \"Bearer sk_secsift_...\"."
  }
}

An unknown or revoked key says "This API key is unknown or revoked." Neither error counts toward your daily calls.

Keep the key secret

Anyone with your key can use your daily calls, and your credits through the MCP server. Keep the key in an environment variable or a secrets manager, out of code other people can read, like a public repository.

The API answers requests from any website, so a page can call the API from the browser. A key in a web page's code is a key anyone can copy, so call the API from your own server instead.

The "Send this call" panels in the endpoint reference keep a pasted key in that browser tab only, and send the key nowhere but the API.

Revoke a key under "API keys" as soon as the key leaks.