Authentication

All REST API endpoints authenticate via an API key in the request header. Persona will provide your key when your integration is set up.

Persona MCP uses OAuth through your Persona Creator account instead of an API key. See Persona MCP for Claude and Codex setup.

Request header

Every request must include:

x-api-key: your-api-key

Authenticated request

curl "https://external-api.prod.insightscompany.io/v1/projects" \
-H "x-api-key: <api_key>"

Property	Detail
Scope	Scoped to your organisation — cannot access other orgs' data
Expiry	Keys don't expire but can be rotated by your account manager
Rate limit	Default limits apply — contact your account manager if you need higher throughput

Never expose your API key in client-side code, mobile apps, or public repositories. All requests should originate from your server.

If authentication fails, the API returns a 401 with the following body:

{
  "error": {
    "code": "invalid_api_key",
    "message": "API key is invalid or has been revoked."
  }
}

Status	Meaning
`401`	Missing, invalid, or inactive API key
`429`	Rate limit exceeded — back off and retry