Authentication
API keys, where to keep them, rotation and revocation.
Every request carries a key in the Authorization header:
Authorization: Bearer sk_live_a1B2c3D4…Keys are created in the console. You see the full key once; we store only a SHA-256 hash and the first eight characters for display. Up to ten keys per account, each with a name, so one key per service or environment is the normal setup.
Rotate a key from the console: a new key is issued immediately and the old one keeps working for 24 hours. Revoke takes effect at once.
Never ship a key to a browser or an app bundle. If a key leaks, revoke it; the console shows when each key was last used and from which network prefix (never a full address).
Missing or wrong keys answer 401 invalid_api_key, revoked or rotated-out keys 403 key_revoked.