Authentication

Every request is authenticated with a bearer token in the Authorization header. Your key is shown to you exactly once, at creation — we store only a salted hash of it, so we cannot show it to you again if you lose it.

Authorization: Bearer YOUR_API_KEY

Live vs. test keys

Every account can generate both a live key (charges real credits, hits the real network) and a test key (for integration testing, in the dashboard).

Revoking a key

Revoking a key from the dashboard is immediate and irreversible. Any request against a revoked key fails instantly with 401 REVOKED_API_KEY — there is no grace period, so rotate before you revoke, not after.

Keeping your key safe

• —Never put your live key in client-side code — it belongs on your server only.
• —Never commit a key to source control, even a private repo.
• —If a key leaks, revoke it immediately from the dashboard and generate a new one.