Why GET /api/v1/health needs no Bearer token

GET /api/v1/health is public and does not require a Bearer token. A member, a signer, or a monitor can hit it without minting ip_…. The body reports flags such as emailConfigured, smsConfigured, driveConfigured, and paymentsLive. That is health-public honesty: a 200 on health is not permission to POST /api/v1/packets, not a workspace secret, and not a Free-plan tease that Billing will print a token.

Who can mint at all is members cannot mint API tokens. How to mint and revoke is mint and revoke API Bearer tokens. Create-then-fill-then-send is API fill then send. Desk help is Docs. This guide is why health does not sit behind Authorization: Bearer ip_….

Ask Inkpacket for GET /api/v1/health needs no Bearer token to open this article. Ask how the API works to open help. Ask how to create an api token to open Settings #tokens. Those phrases stay on the product screens. This article is the public version of why a monitor can read flags without a secret, and why that read is not a send.

What health reports

• emailConfigured — Resend is set. Invite mail can leave. Missing: Invite email was not sent — copy the link.
• Text-message (SMS) is coming soon. Reminders go out by email today.
• driveConfigured — Drive credentials are set. Missing: Drive not configured.
• paymentsLive — Stripe checkout is on. Off: Payments not live. Signing still works.

Settings cards show the same flags. Send returns emailSent and emailError next to signingUrl. Health is the public twin of those cards — no org scope, no last-used bump, no tokenHash. Successful envelope calls update last-used time on a real ip_…. Health does not. Do not treat a green health body as proof this worker can void an envelope.

What this is not

• Not an envelope list. GET /api/v1/packets still wants Authorization: Bearer ip_…. A missing header returns 401 Bearer token required.
• Not a member mint. Members can send from the desk. Members cannot mint. Health does not change that.
• Starter lists more envelopes than Free — 20 versus 5. A health 200 does not raise the cap.
• Not checkout. Billing is not open. Paying a listed price does not hide health or print a secret.

A worker that only needs to know whether mail is configured can hit health. A worker that creates envelopes still needs an owner or admin to mint, then stores the secret. Do not paste ip_… into an envelope title. Do not send the secret through a signing invite — that object is a PDF link, not a seat. Workspace team invite versus signing invite is those two URLs.

The click-path

1. Hit GET /api/v1/health from a browser or a monitor. No Authorization header.
2. Read the flags. If emailConfigured is false, plan to copy signing links — copy the signing link after mail skips.
3. If you need POST /api/v1/packets, ask an owner or admin to mint at Settings → API tokens.
4. Call Authorization: Bearer ip_… on envelope routes. Send still counts against the monthly cap.
5. On a phone, tap Open desk menu for Settings. The workspace switcher above Menu will not mint a token or change health.

Each API token allows 120 requests per minute per token. Over that limit, /api/v1 returns HTTP 429 with a Retry-After header. Inkpacket does not send X-RateLimit headers. Send volume over the monthly cap is HTTP 402 ENVELOPE_LIMIT, not 429. The send guard is HTTP 402 ENVELOPE_LIMIT. Access-code 429 is a signer PIN lockout, not this endpoint — access-code 429 versus API rate limit. Reminders go out by email today. Text-message (SMS) is coming soon. Email still soft-fails after a member or an API send. Text-message (SMS) is coming soon. Drive missing: Drive not configured.

Ask and tokens

Ask Inkpacket for GET /api/v1/health needs no Bearer token to open this article. Ask how to create an api token to open Settings. Marketing Ask stays site Q&A and deep links. It will not mint a Bearer token or POST an envelope from this article. Health stays public even when every other /api/v1/packets route is locked.

Caps and what is not open yet

Reading health is not a send. Send is. Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. Those flags are what health reports — they do not mint a token or hide Settings. The FAQ and Public API use GET /api/v1/health is public and does not require a Bearer token in the same words.

Monitor the flags. Mint ip_… when a worker needs envelope routes. Stay on that organization. Open a workspace on Free — see published pricing — and hit health without a header on purpose so health-public honesty is a 200 you already saw, not a secret you opened Billing to buy.