Connect your own applications to ContextLab with scoped, workspace-bound API keys.
Developer API
The Developer API lets external applications read ContextLab resources — workspaces, projects, project context, blueprints, and libraries — using scoped API keys.
CLI tokens (
ctxlab login) and IDE integrations are unchanged. Developer API keys are for your own apps, agents, and services.
Authentication
Create a key in Integrations → API & Access → Developer API. The secret is shown once — store it like a password.
Send it as a Bearer token:
curl https://context.web.id/api/public/v1/workspaces \
-H "Authorization: Bearer ctxk_xxxxxxxx_xxxxxxxx"
Keys are bound to a single workspace and a set of scopes. A key can never read resources from another workspace, even if the ID is known.
Scopes
| Scope | Grants |
|---|---|
workspace:read | List and read the bound workspace |
project:read | List projects in the workspace |
context:read | Read composed project context (CONTEXT.md) |
blueprint:read | List and read blueprints |
library:read | List unlocked libraries |
All scopes are read-only. Write scopes are not exposed.
Endpoints
Base URL: https://context.web.id/api/public/v1
| Endpoint | Scope | Description |
|---|---|---|
GET /workspaces | workspace:read | The bound workspace |
GET /projects | project:read | Projects in the workspace |
GET /projects/:id/context | context:read | Composed context document (markdown) |
GET /blueprints | blueprint:read | Blueprints in the workspace |
GET /blueprints/:id | blueprint:read | A single blueprint |
GET /libraries | library:read | Libraries unlocked by the key owner |
Errors
| Status | Meaning |
|---|---|
401 | Missing, invalid, expired, or revoked key |
403 | Key lacks the required scope |
404 | Resource not found in the bound workspace |
Error bodies never include the key material.
Usage & Limits
API requests count toward your existing plan usage and appear in Activity. Keys track last_used_at and a request counter, visible in the Developer API panel. Optional expiration dates are supported.
Revocation
Revoke a key at any time from Integrations → Developer API. Revocation is immediate — the next request with that key returns 401.
AI Operations
If an API-driven operation invokes AI, it flows through the existing AI Gateway with your plan entitlements, credits, and BYOK settings — the API never bypasses them.