Most of the time, Sutra is something you work inside. But every so often you want it to talk to the rest of your world — to sync new members into your CRM, pull participation data into a report, or let another tool act on your space while you sleep. That's what the Sutra API is for: secure, server-to-server access to the same workspace you manage by hand.
An API key is the credential that makes this possible. It identifies a single integration, carries only the permissions you grant it, and can be rotated or revoked at any time. This article covers what the API can reach, how to create a key, and how to keep your keys safe.
Want to connect an AI assistant like Claude, ChatGPT, or Cursor instead of writing code? See Connect AI tools to Sutra with the MCP server.
Before you start
The API and developer dashboard are available on the Silver and Gold plans.
You'll need manager access to the workspace whose data you want to reach.
This is a developer-facing feature. You (or whoever you hand the key to) should be comfortable making authenticated HTTP requests.
The full endpoint reference, authentication details, and code examples live in the developer documentation: sutra.co/developers/docs. Keep it open alongside this guide.
What you can do with the API
The Sutra API is a versioned, JSON REST surface that covers the core operating primitives of your workspace — not just a thin slice of content. With the right scopes, a key can read and manage:
Spaces and their child spaces — create, read, update, and reorder
Members and invitations — including bulk invite, approve, and cross-space listing for CRM sync
Content, messages, and replies — the building blocks of a space and its discussions
Plans, payments, and coupons — pricing configuration and payment records
Broadcasts — draft, send, and track delivery status
Participation analytics — aggregate and per-member data, with CSV export
Webhooks — so external systems can react to events in Sutra in real time
This surface is kept deliberately separate from the internal endpoints that power the Sutra web and mobile apps, so it can stay stable as the product evolves. The documentation is the source of truth for the exact resources and fields available.
Create an API key
Open your workspace settings and go to the API (developer) area.
Create an application and give it a clear name that describes its job — for example, CRM sync or Reporting pipeline.
Issue a token and choose the scopes it needs. Grant routine read scopes (for example, members:read) freely, and add sensitive scopes — email, payments, broadcast send — only when the integration truly requires them.
Scope the token to a root space, and optionally restrict it further to specific child spaces, so it can only touch the part of your workspace you intend.
Copy the key when it's shown. It looks like sutra_live_sk_… and is displayed only once — store it in a secrets manager or your tool's credential store, never in client-side code or a public repository.
Use your key
Send the key as a bearer token in the Authorization header on every request. To confirm a key works and see exactly what it can access, call the introspection endpoint described in the docs before wiring up the rest of your integration. The developer documentation includes ready-to-run examples for each endpoint.
Keep your keys secure
Give each integration its own named key, scoped to only what it needs. One key per tool makes it easy to see what's using your data and to revoke a single tool without disrupting the others.
Rotate keys periodically. Rotation supports a grace period, so you can swap in a new key before retiring the old one — no downtime for your integration.
Revoke a key the moment a tool is retired or you suspect a secret has leaked.
Check the last-used time and IP for each token in the developer dashboard to spot any unexpected activity.
What happens next
Once a key is active, your integration can start making requests immediately, and each key's last-used time and IP update in the dashboard so you can confirm it's working. Sensitive actions are recorded in an audit trail you can review later. When you're ready for Sutra to push events to you — rather than you polling for changes — add a webhook endpoint so your systems stay in sync in real time.
Troubleshooting
Getting a 401 (unauthorized)? The key is missing, mistyped, revoked, or expired. Check the Authorization header and confirm the key is still active in the dashboard.
Getting a 403 (forbidden)? The key is valid but lacks the scope or space access for that request. Add the missing scope, or widen the token's space restriction.
Can't find the API settings? Confirm your workspace is on the Silver or Gold plan and that you have manager access.
Lost the secret? A key's secret is shown only once and can't be recovered. Issue a new token and revoke the old one.