REST API
Base URL
https://workthin.app/api/v1API Key Authentication
For programmatic access, use an API key as a Bearer token.
Generate an API Key
- Open the workthin web UI
- Navigate to Settings > API Keys
- Click Create Key
- Copy the key (shown only once)
API keys use the wt_ prefix (e.g. wt_a1b2c3d4e5f6g7h8i9j0).
Usage
Include the key in the Authorization header:
curl https://workthin.app/api/v1/knowledge \
-H "Authorization: Bearer wt_a1b2c3d4e5f6g7h8i9j0"Revoke a Key
Navigate to Settings > API Keys and click Revoke next to the key. Revoked keys return 401 Unauthorized immediately.
Cookie-Based Authentication (Supabase)
The web UI uses Supabase cookie-based authentication. This is handled automatically by the browser — no manual configuration needed.
Device Code Flow (CLI)
The CLI uses a device code flow for authentication:
wt logingenerates a device code- User opens the verification URL in a browser
- User enters the code and signs in
- CLI receives and stores credentials in
~/.workthin/config.json
Endpoints
| Method | Path | Description |
|---|---|---|
POST | /auth/device-code | Request a new device code |
POST | /auth/device-token | Poll for token after user authorization |
Key Scopes
Keys inherit the permissions of the user who created them. A key created by a project admin can access project-scoped knowledge.