Authentication

Every call needs an API key from a Pro account, made on the API keys page.

• Put the key in the Authorization header as a bearer token. Tools that can't set that header can use X-API-Key instead. Keys in the URL are not accepted, so they never end up in logs.
• A key opens only the data its scopes cover. A call outside them answers 403 missing_scope. Change a key's scopes on the keys page at any time.
• Keys are stored as a one-way hash: if you lose one, make a new one.
• Keep keys on servers and in environment variables, never in a web page or an app bundle.
• Revoking a key stops it within 15 seconds.
• An account can hold up to 10 live keys.

Updated 2026-11-02 17:12 UTC