Authentication
API keys
Every request must carry an API key:
Authorization: Bearer pk_live_YOUR_KEY
# or, equivalently:
X-API-Key: pk_live_YOUR_KEY
Keys are issued once, at account creation and via POST /v2/api_keys. We only
store a SHA-256 hash — if you lose a key, revoke it and create a new one.
| Action | Endpoint |
|---|---|
| List keys (prefix only, never the full key) | GET /v2/api_keys |
| Create a key | POST /v2/api_keys |
| Revoke a key | DELETE /v2/api_keys/{id} |
Rules worth knowing:
- Revocation is immediate.
- You cannot revoke your last active key (you would lock yourself out) — create a replacement first.
last_used_atis tracked per key, so you can find and retire stale keys.
Errors
| Status | Meaning |
|---|---|
401 |
Missing, invalid, or revoked key |
403 |
Key is valid but the account is suspended |
Good practice
- One key per system (production app, staging, CI) — never share keys between environments.
- Rotate keys periodically: create the new key, deploy it, revoke the old one.
- Keys grant full account access. Keep them out of source control, logs, and client-side code.