Get started

Authentication

Create an API key in the dashboard. The full key is shown only once. Store it in your server’s environment, not in source control or browser code.

Send the key in a header

All six endpoints accept x-api-key. Every request also needs Content-Type: application/json.

Request headers 
x-api-key: YOUR_API_KEY
Content-Type: application/json

You can instead use a Bearer token with the same key:

Alternative authentication 
Authorization: Bearer YOUR_API_KEY

Do not send both headers. If both are present, x-api-key takes precedence.

Keep keys private

Proxy browser and mobile requests through your server. Never include a secret key in public bundles. Production requests must use HTTPS.

Revoke a compromised key in the dashboard and create a replacement. Revocation takes effect within the next key sync, normally 5 seconds.

The key query parameter remains available for compatibility. Prefer headers so keys do not appear in URL logs, history or analytics.

Authentication failures

A missing, invalid or revoked key returns HTTP 401 with code unauthenticated. These requests do not spend credits.