Authentication

Every request is authenticated with a bearer token in the Authorization header. Your key is shown to you exactly once, at creation — we store only a salted hash of it, so we cannot show it to you again if you lose it.

Authorization: Bearer YOUR_API_KEY

Revoking a key

[TO BE CONFIRMED] Revocation is fully supported once a key's status is set to revoked — any request against it fails instantly with 401 REVOKED_API_KEY, no grace period. There is no self-service "Revoke" button in the dashboard yet, though — contact support if you need a key revoked today.

Keeping your key safe

• —Never put your live key in client-side code — it belongs on your server only.
• —Never commit a key to source control, even a private repo.
• —If a key leaks, contact support to have it revoked immediately, and generate a new one.