Authentication
Authenticate to the Airbyte Sync API with an agency key for read-write access or a location secret key for read-only access.
Authentication
The Airbyte Sync API uses the same key model as other client-facing Mythic APIs. Every request must carry either an agency key or a location secret key. The key both authenticates the caller and scopes every response to the owning agency.
Bearer token. Format: Bearer ak_... for an agency key or Bearer sk_... for a location secret key.
Key types
Grants full read-write access to everything owned by the agency, including provisioning, connection creation, sync triggering, and schedule changes. The agency is resolved directly from the key.
Grants read-only access. The agency is resolved from the location the key belongs to; the location must be linked to an agency. Any write endpoint returns 403.
Access matrix
| Endpoint group | ak_ (agency) | sk_ (secret) |
|---|---|---|
GET /platforms, /config, /connections, /sync-events, /stats, /health | Yes | Yes (read-only) |
POST /config/provision | Yes | No (403) |
POST, PUT, DELETE on /connections | Yes | No (403) |
POST /connections/{id}/sync, PATCH /connections/{id}/schedule | Yes | No (403) |
Treat both key types as secrets. An ak_ key can create pipelines and trigger syncs that incur cost, so never expose it in client-side code, public repositories, or logs.
Example request
curl https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/connections \
-H "Authorization: Bearer ak_your_agency_key"
A missing or malformed key returns 401:
{
"error": "Missing authorization"
}
Using a read-only sk_ key on a write endpoint returns 403:
{
"error": "Write access requires an agency key (ak_)"
}