Authentication

API keys

All API requests are authenticated using Bearer tokens passed in the Authorization header:

Authorization: Bearer tx_live_xxxxxxxxxxxxxxxxxxxxxxxx

API keys are scoped to your account and carry your billing identity. Treat them like passwords — never commit them to source control.

Key prefixes

Use test keys during development and integration testing. Switch to a live key only in production.

Creating keys

1. Open Dashboard → Settings → API Keys
2. Click Create new key
3. Name it (e.g., backend-prod, mobile-staging)
4. Copy the key immediately — it is hashed before storage and cannot be retrieved again

Security best practices

• Never hardcode keys in source files or Docker images — use environment variables or a secrets manager
• Use one key per application so you can revoke individual keys without affecting other services
• Rotate keys every 90 days — create a new key, deploy it, then revoke the old one
• Monitor usage — the dashboard shows per-key token consumption; anomalies may indicate a leaked key
• Set IP allowlists (Pro plan and above) — restrict which IP addresses can use a key

Revoking keys

Keys can be revoked instantly from Dashboard → Settings → API Keys. Revoked keys are rejected within seconds across all regions.

Error responses

If authentication fails, the API returns:

{
  "error": {
    "message": "Invalid API key provided.",
    "type": "authentication_error",
    "code": "invalid_api_key"
  }
}

HTTP status: 401 Unauthorized