API access

API access has two surfaces in the app:

• The interactive GraphQL editor at /api explores the typed schema, runs queries and mutations, and documents the standard subscription endpoint. On the first signed-in visit, Gentleward creates one managed editor key and loads it into that browser session. The key is shown separately, does not consume a personal-key slot, and can be regenerated at any time.
• The API keys account page at /account/api-keys creates longer-lived bearer keys for trusted personal tools and automations. Personal keys are shown once, named by you, and can be revoked later. Free accounts may hold 4 personal keys; Supporter and Premium accounts may hold 25.

Send API requests with:

Authorization: Bearer <token>

User API keys are scoped. GraphQL checks the required scope at each root field, so a client receives only the access its key was granted. Each key has its own distributed sliding-window rate limit: 30 requests per minute on Free and 300 per minute on Supporter and Premium, with a 429 response when the window is full. Signed-in browser sessions have a separate, roomier window (120 requests per minute on Free and 600 on paid tiers) so one session cannot crowd out another.

Why it’s here. Automation should be explicit and revocable. A key belongs to a tool you trust; if that tool no longer needs access, revoke the key and the door closes.

A contemplative thread. Consent is not only social. It also applies to software: give only what is needed, and keep the ability to withdraw it.