Authentication

The Skroll API uses organization API keys, sent as a bearer token on every request.

Get a key

An owner or admin creates keys in Settings → Integrations. The key is shown once at creation; only its hash is stored, so copy it then. A key acts as its creator for writes. It can read anything the organization sees, but only modify skrolls that creator owns. Removing a member from the organization disables their keys immediately.

Send the key

Pass the key in the Authorization header:

curl

curl https://skrollai.com/api/v1/decks \
  -H "Authorization: Bearer sk_..."

Rate limits

Limits are per key, in fixed one-minute windows. Exceeding a bucket returns 429 with a Retry-After header.

Bucket	Limit	Routes
standard	120 / min	Everything not listed below
heavy	10 / min	generate_deck, create_brand_from_url, create_export
unauthenticated	20 / min per IP	Requests with a missing or invalid key

Errors

Every non-2xx response uses one envelope. code is a stable machine string; featureId appears on 402 to name the metered feature that ran out of allowance.

json

{
  "error": {
    "code": "not_found",
    "message": "Skroll not found.",
    "featureId": "decks"
  }
}