Authentication

The Statly API uses API keys for authentication. All requests must include a valid API key.

Getting an API Key

1. Log in to your Statly Dashboard (opens in a new tab)
2. Go to Settings → API Keys
3. Click Create API Key
4. Give it a name (e.g., "CI/CD", "Terraform")
5. Copy the key immediately—it won't be shown again

Using Your API Key

Include the key in the Authorization header with the Bearer scheme:

curl -X GET "https://statly.live/api/v1/monitors" \
  -H "Authorization: Bearer sk_live_your_api_key_here"

Key Format

API keys follow this format:

sk_live_<64-character-hex-string>

Example:

sk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6

Scopes

API keys can have different permission scopes:

When creating a key, select the minimum scopes needed for your use case.

Plan-Based Access

API access level depends on your plan:

Security Best Practices

Environment Variables

Never hardcode API keys. Use environment variables:

// Node.js
const apiKey = process.env.STATLY_API_KEY;
 
fetch('https://statly.live/api/v1/monitors', {
  headers: { 'Authorization': `Bearer ${apiKey}` }
});

Rotate Keys Regularly

Create new keys and revoke old ones periodically:

1. Create a new key with the same scopes
2. Update your applications to use the new key
3. Verify everything works
4. Delete the old key

Limit Scopes

Give each key only the permissions it needs:

• CI/CD for creating incidents: incidents:write
• Dashboard integration: monitors:read, incidents:read
• Full automation: *

Revoking Keys

To revoke an API key:

1. Go to Settings → API Keys
2. Find the key in the list
3. Click Delete
4. Confirm deletion

The key is immediately invalidated. Any requests using it will receive a 401 Unauthorized response.

Troubleshooting

401 Unauthorized

{
  "error": "invalid_api_key",
  "message": "API key not found or invalid"
}

Solutions:

• Verify the key is correct (no extra spaces)
• Check the key hasn't been deleted
• Ensure you're using Bearer scheme
• Confirm the key belongs to your organization

403 Forbidden

{
  "error": "forbidden",
  "message": "Insufficient permissions: 'monitors:write' scope required"
}

Solutions:

• Check your API key has the required scope
• Upgrade your plan if using Free tier
• Create a new key with additional scopes