Auth is a personal access token, minted in account settings. Prefix sng_, shown once. Send it as Authorization: Bearer sng_…. Session cookies are ignored on this tree — a browser session is not an API credential.
Scopes are read and write (write implies read). Optional workspace allow-list. Every call still runs the same permission check as the app: viewers read, guests stay project-scoped, a token cannot escalate.
Rate limits are abuse protection, not a meter. A 429 includes Retry-After. There is no usage UI and no plan cap.
Files, chat, whiteboards, billing, member admin and automations composers stay in the app. Webhooks fire task.created, task.updated, task.completed, comment.created with X-Sahnga-Signature: sha256=….
Endpoints
GET/api/v1/workspaces/{wsId}/projectsList projects the token owner can see.
GET/api/v1/workspaces/{wsId}/projects/{projectId}One project.
GET/api/v1/workspaces/{wsId}/projects/{projectId}/tasksTasks in a project (open by default).
GET/api/v1/workspaces/{wsId}/tasks/{taskId}One task.
POST/api/v1/workspaces/{wsId}/tasksCreate a task. Write scope.
PATCH/api/v1/workspaces/{wsId}/tasks/{taskId}Update a task. Write scope.
GET/api/v1/workspaces/{wsId}/tasks/{taskId}/commentsComments on a task.
POST/api/v1/workspaces/{wsId}/tasks/{taskId}/commentsAdd a comment. Write scope.
GET/api/v1/workspaces/{wsId}/me/tasksTasks assigned to the token owner.
GET/api/v1/workspaces/{wsId}/search?q=Title prefix search.
GET/api/v1/workspaces/{wsId}/webhooksList outbound webhooks. Write scope to create.
POST/api/v1/workspaces/{wsId}/webhooksCreate an HMAC-signed HTTPS webhook.
Prefer an AI client? See MCP. Same services, same token, no second write path.