Base URL

The single origin every Steve API request goes to, and how to compose request paths.

Every Steve API request goes to one origin:

https://api.meetsteve.io

There is no separate host per endpoint family. Build request URLs by joining this origin with the versioned path:

https://api.meetsteve.io/api/v1/workflows

/api/v1 is the stable integration namespace.

Read the base URL from configuration rather than compiling it into your client, so a future migration does not require a code change.

Trailing slashes

Paths are matched exactly. A trailing slash or a doubled slash is a different path and returns 404, not the endpoint you meant:

GET /api/v1/companies    → matches
GET /api/v1/companies/   → 404
GET //api/v1/companies   → 404

Strip trailing slashes when composing URLs, and make sure your configured base URL does not end in one.

/api/v1 responds with Access-Control-Allow-Origin: *. These routes authenticate with an API key and nothing else — no cookies, no ambient browser session — so a permissive origin policy does not widen access.

That wildcard does not make the API safe to call from a browser. An API key shipped in frontend code is public. Call /api/v1 only from a server you control — see Authentication.

Trailing slashes

CORS

On this page