Get an API key

An org developer authenticates the SDK with a VIITE_API_KEY — a single key that gives a consumer site read access to your organization’s public surfaces (the offers/pricing catalog and the headless blog). The key identifies your org and the admin who created it, so any admin’s key returns the whole org’s catalog.

Generate a key

API keys are minted from the dashboard — the docs site can’t create one because issuing a key requires an authenticated, org-admin session.

1. Sign in to the dashboard at business-studio.viite.ai.
2. Go to Settings → API keys (/settings/api-keys).
3. Click New API key, give it a name (e.g. viite.ai site) and an expiry, and create it.
4. Copy the key immediately — it’s shown only once. The dashboard stores only a hash; if you lose it, revoke and mint a new one.

Only org admins/owners can create or revoke keys. Members can view the list.

Caution

Treat the key like a password. Put it in your consumer site’s server-side environment as VIITE_API_KEY — never commit it and never ship it to the browser bundle. The SDK call must run server-side.

Use it with the SDK

Pass the key via getToken; every request is sent as Authorization: Bearer <key>:

import { PlatformApiClient } from '@abeauvois/platform-sdk';

const client = new PlatformApiClient({
  baseUrl: 'https://platform-api.viite.ai',
  getToken: () => process.env.VIITE_API_KEY,
});

// Your org's active offers (the pricing page):
const offers = await client.offers.listPublic();

// Your org's published blog posts:
const posts = await client.blog.listPublished();

Both reads are scoped to the key’s org — no IDs to pass, no cross-org leakage.

Rotating & revoking

• Rotate: create a new key, deploy it to your consumer site’s env, then revoke the old one.
• Revoke: delete the key from Settings → API keys. Revocation is immediate; any site still using it starts getting 401s.

CLI alternative

For scripted/CI minting there’s a server-side script that performs the same flow (sign in → POST /api/api-keys):

PLATFORM_API_URL=https://platform-api.viite.ai \
  bun run apps/api/scripts/mint-blog-key.ts --name "viite.ai site" --expires-days 365

It prints a ready-to-paste VIITE_API_KEY=… line. The signed-in account must be an admin/owner of its active org.