Skip to main content
Every request is authenticated with a secret key sent in the X-Auth-Key header.

​
Getting a key

Generate keys from the API keys section of your dashboard. You can create several, name them per environment, and revoke or rotate any of them independently. The secret is shown once at creation, so copy it then.

​
Keep your key secret

Your key authenticates billable requests. Anyone who has it can spend your credits.

Keep it server-side

Call the API from your backend. Never ship a key in a browser bundle, mobile app, or public repo.

Rotate on exposure

If a key leaks, rotate it from the dashboard. The old secret stops working immediately.

​
Errors

A missing or invalid key returns 401 Unauthorized. See Errors & Status Codes.