Authentication

Create a key (In place)

Owners and Admins create keys in Settings → API keys:

Choose Create key and name it after the system that will use it.
Pick its scopes, or start from Read-only, Case automation or Full access. You can only grant what your own role allows.
Optionally limit it to IP addresses (one address or range per line, like 203.0.113.0/24) and set an expiry date.
Copy the key. Sealio shows it once; store it in your secrets manager.

A key looks like sk_live_ca_4f9a2c1b_…. The part before the last underscore identifies it in the list; the rest is secret.

curl https://api.sealio.ca/v1/me \
  -H "Authorization: Bearer sk_live_ca_4f9a2c1b_…"

/v1/me returns the key's scopes and who it acts as.

A key acts as the person who created it, with their current role, narrowed to the key's scopes. If their role changes, the key follows; if they leave the firm, the key stops working. Create a new key from another admin before someone leaves.
Canada keys (sk_live_ca_…) work only on api.sealio.ca, India keys only on api.sealio.in.
Everything a key does is recorded in the audit log as "API key name", and so is every refused attempt with a revoked, expired or IP-blocked key.

Scope	Allows
`clients:read` / `clients:write`	List and read clients; create, update, archive and restore them
`templates:read` / `templates:write`	Read checklist templates; change them
`requests:read` / `requests:write`	List and read requests; create, send and cancel them
`documents:read`	File details on a request
`documents:download`	Download links
`documents:review`	Accept and return files
`users:read`	Team members
`webhooks:manage`	Webhook endpoints, deliveries and resends
`audit:read`	Audit events

Rotate creates a new key with the same settings. Choose how long the old key keeps working (up to 7 days) so you can switch without downtime.
Revoke stops a key at once.