Authentication
API keys, header formats, rotation and key management.
Sending your key
Every request needs your API key (prefix ak_), in either header form:
# Option A — simple header
curl -H "X-API-Key: ak_your_key_here" …
# Option B — standard bearer auth
curl -H "Authorization: Bearer ak_your_key_here" …Both are equivalent. Requests without a key get 401 MISSING_API_KEY; unknown or revoked keys get 401 INVALID_API_KEY.
How keys are stored
Keys are stored hashed on our side — we cannot recover a lost key, only issue a new one. The raw key is shown exactly once, at creation or rotation.
Managing keys
From the portal you can hold up to 5 active keys per account, and:
- Label keys ("production", "staging") to keep usage readable.
- Rotate a key — the key ID and its settings stay, the secret changes, the old secret dies instantly.
- Revoke a key permanently.
All keys on an account share one monthly quota — usage is metered per account, with per-key breakdowns available on the usage page.
Trial keys and expiry
Trial keys carry a hard expiry (14 days from signup) and a 5,000-request cap. Past either limit the key returns 402 TRIAL_EXPIRED — a hard stop, not a downgrade. Creating additional keys never extends the trial: every trial key inherits the account's original deadline.
Key safety
- Never ship an API key in client-side code (browser or mobile binaries). Proxy calls through your backend.
- Rotate immediately if a key leaks — rotation is instant and free.