Workspaces & API keys
Workspaces
A workspace is your tenant boundary in ZenVault. Every account, address, transfer, external wallet, webhook endpoint, and usage counter belongs to exactly one workspace, and your API key resolves to exactly one workspace — so you can only ever see and act on your own data.
Workspaces are provisioned by the ZenVault team. A single organization can have several (for example a sandbox workspace and a production one).
API keys
Authenticate every /v1 request with a bearer key:
Authorization: Bearer zv_<8-char-prefix>_<secret>
- Only a hash of the secret is stored. The full key is returned once, at creation — store it in your secret manager.
- Lost keys are rotated, not recovered.
- A workspace can hold multiple keys (e.g. per service), each with its own scopes, and any key can be revoked independently.
Scopes
Keys are scoped per capability. Calling an endpoint whose scope your key lacks
returns 403. Ask for the narrowest set your integration needs.
| Scope | Grants |
|---|---|
accounts:read | List/read accounts |
accounts:write | Create/update accounts, activate assets |
addresses:read | List deposit addresses |
addresses:write | Generate deposit addresses |
balances:read | Read balances |
transfers:read | List/read transfers |
transfers:write | Create transfers (internal / external / contract-call / approve) |
external-wallets:read | List/read external (withdrawal) wallets |
external-wallets:write | Create external wallets, manage allowlisted assets |
webhook-endpoints:read | List/read webhook endpoints |
webhook-endpoints:write | Create/update/rotate/delete webhook endpoints |
signing:read | List/read raw signing requests |
signing:write | Create raw signing requests |
Rate limits
Each workspace has its own request budget (currently 600 requests / minute),
so a busy workspace can't starve a quiet one. Over-budget requests return 429.
Usage is also metered per workspace.