Authentication

Bearer tokens

Every request must include a personal access token in the Authorization header:

Authorization: Bearer sv_live_<24 chars>

Tokens are generated in Savee → Settings → Developer. Each user has at most one active token at a time — generating a new one revokes the previous.

Savee stores only a SHA-256 hash of the token; the raw value is shown exactly once on generation. If you lose it, generate a new one — the old token is unrecoverable.

Treat it like a password

• Never commit tokens to source control.
• Never expose them in client-side code that runs in a browser.
• Rotate immediately if you suspect a leak: open settings, click Regenerate. Existing integrations using the old token will start receiving 401 within seconds.

Paid-user only

The API is gated behind any active Savee subscription. If your subscription lapses, your existing tokens stop working until renewal — they aren't deleted, just rejected with a 402 PAYMENT_REQUIRED until billing is current again.

Errors

All error responses use the same envelope:

{
	"error": {
		"code": "UNAUTHORIZED",
		"message": "Missing Bearer token"
	}
}