Authentication and scope

Send your key as an HTTP bearer credential:

Authorization: Bearer YOUR_LEDGEKIT_KEY

Create keys in your app's console. A key grants either read or write access and belongs to the test or live environment. A write key does not grant reads. The key selects the app and environment for trace reads and both upload operations; uploads do not accept an app or environment override.

Datasets belong to the app. A read key for either environment can download that app's dataset, including saved items originating in either environment. Each item's sourceMode identifies where it originated.

Credential failures

An invalid, missing, or revoked key returns 401 invalid_api_key. A valid key without the operation's required access returns 403 insufficient_key_access. Changing filters cannot expand a key's scope.

Swift credential providers

The HTTP transport, dataset client, and evaluation reporter accept credentials: .apiKey(key) or credentials: .tokenProvider(provider). A token provider retrieves credentials using your application's credential flow. See keys and environments.

Keep read keys in trusted tooling: trace and dataset responses contain captured application inputs and model content. Avoid committing keys to source or examples.