Agentic Fabriq
Stormboard
DESIGN · FILES & DOCS
Storms, ideas, votes, and comments in the boards that person can reach.
Connecting Stormboard in practice
Stormboard answers a bad API key with 403 rather than 401, so code that branches on 401 to trigger a reconnect will read a dead credential as a permission problem. The rate limit is published only as RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and RateLimit-Policy headers with a 429 — never as a number.
Scopes that draw scrutiny
X-API-KeyMinted per person at stormboard.com/users/account#api, so the key carries that individual’s board access rather than an application’s. There are no scopes.
Rate limits
- The API "uses standard rate limiting headers and returns a http code 429 when you have reached your limit in the period".
- Headers exposed are RateLimit-Limit (requests per period), RateLimit-Remaining, RateLimit-Reset (seconds) and RateLimit-Policy.
- No numeric limit is published, so the policy header is the only way to learn it.
Who has to approve
The OAuth 2.0 route is not self-serve: Stormboard’s own instruction is to "contact support to register your OAuth client", so anything beyond a per-user API key goes through Stormboard. Endpoint access also varies by tier — Public, Team Members and Team Owners — so the same call can succeed for one member and fail for another.
Worth knowing
- Authentication failures are 403, not 401.
- Dates supplied without a timezone component "will be assumed to be in UTC", which quietly shifts anything generated in local time.
- Because keys are per user, an integration inherits one person’s board membership and loses access when they leave.
- A malformed URL can return 404 rather than a 400, so a path-building bug looks like a missing object.
Checked against Stormboard API documentation (2026-09-29), Stormboard API authentication (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Stormboard behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.