Authentication

The Sim API accepts API keys and, when enabled by your deployment, OAuth access tokens. API keys support automation and the SDKs. OAuth lets the CLI and registered applications act on your behalf with permissions you approve.

Sim supports two types of API keys — personal keys and workspace keys — each with different billing and access behaviors.

Key Types

Generating API Keys

To generate a personal key, open Account settings → Sim API keys. Workspace administrators can create shared keys from Workspace settings → Sim API keys.

Using API Keys

Pass your API key in the X-API-Key header with every request:

curl -X POST https://www.sim.ai/api/v2/workflows/{workflowId}/execute \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"input": {}}'

const response = await fetch(
  'https://www.sim.ai/api/v2/workflows/{workflowId}/execute',
  {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-API-Key': process.env.SIM_API_KEY!,
    },
    body: JSON.stringify({ input: {} }),
  }
)

import requests

response = requests.post(
    "https://www.sim.ai/api/v2/workflows/{workflowId}/execute",
    headers={
        "Content-Type": "application/json",
        "X-API-Key": os.environ["SIM_API_KEY"],
    },
    json={"input": {}},
)

Where Keys Are Used

API keys authenticate access to:

• Workflow execution — run deployed workflows via the API
• Logs API — query workflow execution logs and metrics
• MCP servers — authenticate connections to deployed MCP servers
• SDKs — the Python and TypeScript SDKs use API keys for all operations

OAuth access tokens

Use sim login to authorize the CLI in your browser, or sim login --read-only to request read access. The CLI stores the login locally and refreshes access tokens automatically. See CLI authentication for profiles, sign-in, and sign-out.

Registered OAuth applications send access tokens in the Authorization header:

curl https://www.sim.ai/api/v2/workspaces \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Scopes limit what an application may do; your current workspace membership and role still apply. Each endpoint documents its required scope. Some GET endpoints that perform external discovery require api:write, so HTTP method alone does not determine the permission.

Manage grants in Settings → General → Authorized apps. Revoking an application signs out all of its logins. sim logout revokes the current CLI login and removes it from your machine. The Python and TypeScript SDKs currently use API keys; they do not manage OAuth sign-in or refresh tokens.

Security

• Keys use the sk-sim- prefix and are encrypted at rest
• Keys can be revoked at any time from the dashboard
• Use environment variables to store keys — never hardcode them in source code
• For browser-based applications, use a backend proxy to avoid exposing keys to the client