Authentication
The Platform API authenticates machine requests with project-scoped bearer keys. Keys are issued from the console and stay server-side.
API keys
Keys belong to a service account within a project, and carry that project's scopes and environment. There are two environments:
| Prefix | Environment | Gating |
|---|---|---|
agro_test_ | Test | Deterministic synthetic data. Requires the test-projects flag for your org. |
agro_live_ | Live | Requires organization verification, technical review, and explicit approval. |
Keys are created, rotated, and revoked from your project in the console. The secret is shown once at creation.
Authenticating a request
Send the key as a bearer token:
curl https://api.agroai-pilot.com/v1/platform/me \
-H "Authorization: Bearer $AGROAI_PLATFORM_KEY"A missing or invalid key returns 401; a key without the required scope returns 403. See Errors.
Scopes
Each operation lists the scopes it requires (for example fields:read, observations:write, connectors:sync). Grant a service account only the scopes it needs. The API reference shows the required scopes per endpoint.
Keep keys server-side
Never place a Platform API key in a browser, mobile app, or public repository. These keys are machine credentials. Call the API from your backend and proxy client apps through it. AGRO-AI surfaces — including this site and the console — never ask you to paste a key into a web page.
To experiment without wiring up a backend, use the server-mediated test tools in the console; they execute test-safe operations under your authenticated session, so no permanent key is ever exposed to the browser.