Proof API

How it authenticates

Proof does not use the API token from the GeoDynamics API. It authenticates with a service key you create inside Proof, sent as a bearer token:

Authorization: Bearer sk_<your service key>

Each key carries explicit scopes, granted per key rather than per user, so an integration only gets the access it needs. A key is bound to one environment, which is why no call takes an environment parameter. A key that authenticates but lacks the scope for the call gets 403, not 401.

Creating a key

In Proof, open Settings and then Service keys. Give the key a name, tick the scopes it needs, and add it. The token appears in the list and stays readable there, so you can copy it again later. It starts withsk_. The list also shows when each key was last used, which is the quickest way to tell a live integration from an abandoned one.

Four scopes exist today, one per thing a key can reach:

public:scope:workplacegroup:read

List workplace groups and read one by id.

public:scope:workplacegroup:manage

Create, update and delete groups, and set their workplaces and users.

public:scope:workplace:read

List the workplaces in the environment.

public:scope:user:read

List the active users in the environment.

Read and manage are separate on purpose. An integration that only reports on groups never needs a key that can delete one.

Both APIs answer on api.geodynamics.dev, split by the first path segment: /intellitracer for the GeoDynamics API,/proof for this one. One host to allowlist, one place where rate limiting and DDoS mitigation apply.

Getting notified

We post every API change to the changelog. If you want to talk through a Proof integration,reach out to support.