API keys
Keys for scripts, CI and the REST API.
Interactive agents should sign in instead; keys are for code that runs without you.
Create a key
In Settings → Agents, click API key, name it after where it will live (for example "CI tour sync"), and choose whether it Can publish. Copy the key when it's shown: it's displayed once. GuideMark stores only a hash, so a lost key can't be recovered; revoke it and create another.
Keys look like gm_ followed by 64 hex characters. Send them as a header:
curl https://guidemark.co/api/v1/project -H "Authorization: Bearer gm_…"Scopes
| Scope | Allows |
|---|---|
read | list and fetch tours and tooltips |
write_drafts | create drafts; edit or delete anything that isn't live; complete API checklist items |
publish | publish, unpublish, edit or delete live content, if the project allows agent publishing |
Every key has read and write_drafts.
Limits and safety
- A key works for one project.
- 60 requests per minute per key; over that,
429withRetry-After. - Keys don't expire. Revoke unused ones in Settings → Agents; the list shows when each was last used.
- Never put a key in front-end code. It's for servers, CI and your own machine.