API

The service API is versioned under /v1. Browser sessions use Better Auth. External automation uses a bearer API key.

Authentication

curl https://api.workonrepeat.com/v1/routines \
  -H "Authorization: Bearer $WORK_ON_REPEAT_API_KEY"

An API key is bound to exactly one project. A session can select its active project with the X-Project-Id header, which takes precedence over the wor_project cookie; the API verifies membership either way.

Create a key

Create a key from Dashboard → API keys. Its plaintext form is shown once:

wor_<prefix>_<secret>

The database stores only a SHA-256 hash. Closing the one-time dialog removes the plaintext key from the UI state.

Scopes

New keys default to models:read, routines:read, runs:read, and runs:write. Free and Starter permit read-only API requests; Pro and Scale permit writes. Browser sessions use membership and plan checks rather than API-key scopes.

Envelopes

{ "data": {}, "requestId": "01J..." }

{
  "error": { "code": "routine_not_found", "message": "…" },
  "requestId": "01J..."
}

Endpoints

Models

Each option carries the full reference provider, nullable connectionId, and modelId. A managed reference has provider llmgateway and a null connection; personal references require the exact owning connection. The catalog does not collapse two accounts that expose the same model ID.

Personal model connections

Listing uses the normal read scopes. Connect, reauthorize, and revoke require an authenticated browser session for the exact connection owner; an API key cannot act as that personal owner. Provider flags can make a descriptor visible while its connect action remains disabled.

See Connect a model provider for product ownership, billing, status, and recovery semantics. Live-smoke diagnostics are default-off operator gates and are intentionally omitted from the normal integration surface.

Organizations and projects

Session-only. An API key receives 403 session_required.

Routines

Creating or updating a routine validates the schedule against the cron parser and the model against the live directory. Tool policies must reference a saved connection — inline tools return 400 tool_policy_requires_connection.

Runs

Connections and tool policies

API keys

Session-only.

Billing

Session-only. Billing mutations also require the active project's organization owner and an exact Origin matching UI_ORIGIN; bearer API keys cannot start Checkout or create customer-portal sessions.

The API chooses the Price, customer, and success/cancel URLs. Client-supplied Stripe IDs or redirect URLs are rejected. An already subscribed workspace is sent to the portal rather than creating a second subscription. Checkout's success redirect never grants access. Paid access changes only after a verified Stripe webhook or an authenticated server-side reconciliation against canonical Stripe subscription state.

See Billing for plan periods, cancellation, failed-payment grace, and the stable HTTP 402 contract.

Outside /v1

Limits

Authenticated /v1 traffic is limited per credential in a fixed 60-second window. Responses include X-RateLimit-Limit and X-RateLimit-Remaining; a 429 also includes Retry-After. Request bodies are capped at 1 MB. Run execution is claimed from the durable SQLite queue and processed with bounded worker concurrency.

See Limits and quotas for every bound in one place, and Error codes for the complete list of failures.