Skip to main content

​
API keys

Each key belongs to one team. Every request is restricted to that team’s data. Per-route scopes may be enforced in a future release; today any valid key for the team can access all documented /api/v1 routes.

​
Sending the key

Send the full secret in the Authorization header using the Bearer scheme (common pattern for HTTP APIs):
If your client or gateway cannot set Authorization, the same secret is accepted in X-Api-Key.

​
Key format

Keys start with fk_live_ followed by a random secret. Store the full value securely (secret manager, environment variables). Never commit keys to source control or expose them in a browser.

​
Missing, invalid, or revoked keys

  • No key → 401, message explains missing header.
  • Invalid key → 401.
  • Revoked key → 401.
Use error.message to distinguish; error.request_id + header X-Request-Id for support.