Authentication
This page covers authentication for the REST API and the SDKs, where the credential is an API key. Vibedasher has two access tiers here: the authenticated API (an API key) and a small public, no-auth surface.
You don't need a key. Install vibedasher-mcp (0.6.0 or later) and run
vibedasher login — browser sign-in, session in your OS keyring. See
Build with your agent. API keys are for the SDKs, for
your own backend, and for headless/CI machines where no browser can open.
API key (X-Api-Key)
The authenticated API — datasets, SQL, visualizations, connections, and more — is
accessed with an API key sent in the X-Api-Key header. That's how both SDKs
authenticate, and how the MCP server authenticates on a
headless or CI machine (via VIBEDASHER_API_KEY, which takes precedence over any stored
login session when it is set).
Get a key
Mint a key in the app under Settings → API keys at
cloud.vibedasher.com. Key creation is deliberately
admin-only and browser-session-only: POST /v1/api-keys requires an account admin
signed in through the app and rejects API-key auth outright, so it is not part of the SDK
surface and you will not find it in the reference. A key cannot mint another key, and a
non-admin member cannot self-provision one — that is the point.
Treat a key like a password: it carries your account's access. Store it in an environment variable or a secret store, never in source control.
Send it
curl https://api.vibedasher.com/api/v1/datasets \
-H "X-Api-Key: $VIBEDASHER_API_KEY"
The official SDKs wire this header for you — you just pass the key when you construct the client:
import { Vibedasher } from '@vibedasher/client';
const client = new Vibedasher({
apiKey: process.env.VIBEDASHER_API_KEY!,
});
const page = await client.datasets.list({ limit: 50 });
from vibedasher import Vibedasher
client = Vibedasher(api_key="<your-api-key>")
client.datasets.list()
One host, routed by your credential
https://api.vibedasher.com/api is the default base URL, and it is the only address you need to
know. The edge in front of it reads your credential — the prefix of your X-Api-Key, or the
region recorded inside a browser session token — and forwards the request to the region that
holds your account's data. Your code never has to say where that is. (region is optional
from @vibedasher/client 4.1.5 and vibedasher 4.3.19 onwards.)
Every region also answers on its own hostname, https://api.{region}.vibedasher.com/api. Those
addresses are fully supported and they are the way to pin a client to one region
deliberately: pass region to either SDK, or set the base URL by hand. An ejected dashboard
does exactly that — it records the regional host it was built against, so the bundle you ship
keeps querying the same place.
A request that carries no credential at all — the public endpoints below, and every CORS
preflight — is served by the default region, eu-central-1.
Public endpoints — no auth
The endpoints under /v1/public/* require no authentication. They serve only content
that has been explicitly published and marked public:
curl https://api.vibedasher.com/api/v1/public/viz/slug/<slug>
Drafts and private dashboards return 404 — there is no way to read unpublished data
through the public surface.
Because these calls carry no credential, there is nothing for the edge to route on, so they reach the default region. If your account's data lives elsewhere, address the public lane at your own region's hostname instead.
What's never exposed
Pure infrastructure and admin plumbing is excluded from the API entirely — admin cache/job/ worker management, the AI-debug and observability viewers, cross-account analytics, WebSocket transport, and direct function invocation. These power the app internally and are not part of the documented surface.
Need something the API doesn't cover yet? Reach out via the contact page.