Authentication

Personal Access Tokens

Create one from Settings → Personal Access Tokens in the app, then pass it:

import { Layer } from '@layer_ai/sdk'

const layer = new Layer({ apiKey: 'pat_...' })

With no apiKey, the SDK reads LAYER_API_KEY from the environment where a runtime has one — which is how a CI job, a render farm, or a scheduled task authenticates without the token reaching the source:

const layer = new Layer()

See authentication for the permission model a token inherits.

OAuth access tokens

Pass a function instead of a string and it is called per request, so a token that expires mid-session is refreshed without rebuilding the client:

const layer = new Layer({ apiKey: () => session.getAccessToken() })

In the browser

A Personal Access Token is long-lived and carries your full account permissions. Anything running in a browser should hold a short-lived OAuth access token instead, obtained through your own sign-in flow.

Choosing a workspace

Every call runs against one workspace. Name it on the client:

const layer = new Layer({ apiKey, workspaceId: '…' })

Or per call, which wins over the client’s:

await layer.projects.list({ workspaceId: '…' })

With neither, the first call that needs a workspace resolves one from the credential. That works when the credential reaches exactly one workspace; when it reaches several the SDK asks you to name one rather than picking. To see them:

for await (const workspace of layer.workspaces.listAll()) {
  console.log(workspace.workspace_id, workspace.name)
}

Pointing at another deployment

const layer = new Layer({ apiKey, baseUrl: 'https://api.app.layer.ai/api' })

That is the default. Override it only to reach a non-production deployment.

Identifying your integration

An integration that names itself shows up as itself in Layer’s API metrics, which is what lets us tell you about a change that affects it:

const layer = new Layer({ apiKey, userAgent: 'unity-bridge/2.1' })

It is appended to the SDK’s own User-Agent, never replacing it.