Keys & auth

Every endpoint authenticates the same way.

The header

Send Authorization on every request — the word Bearer, a space, then the key:

Authorization: Bearer sk-your-key

Missing, malformed, unknown or disabled keys all return 401, with code missing_api_key or invalid_api_key respectively.

Key lifecycle

• Create — self-serve under Account → API platform. Up to 10 keys per account.
• Disable — flip the switch in the edit dialog. Calls are rejected immediately; the record stays and can be re-enabled.
• Delete — takes effect at once and cannot be undone. Make sure nothing in production still uses it.
• Rename — cosmetic only, it does not change the key itself.

Keeping keys safe

• Server side only. A key is your account — it spends your credits. Never ship it in frontend code, an app bundle or a public repo.
• One key per service. If one leaks you disable that one and leave every other caller running.
• Watch the Last used column. It records the timestamp and source IP of the most recent call; an unfamiliar IP means delete and recreate now.