Authentication
Bearer API keys — how they work and how to keep them safe.
Every request to the data APIs is authenticated with your account's single API key, sent as a Bearer token:
Authorization: Bearer sk_live_...There is exactly one active key per account, and it covers every API in the catalog.
Key lifecycle
- Creation. Keys are generated with 192 bits of entropy and shown once. We store only a SHA-256 hash — nobody, including us, can recover a lost key.
- Rotation. Rotating from the dashboard revokes the old key immediately and issues a new one. Rotation is the correct response to any suspected exposure.
- Revocation propagation. Key checks are cached at the edge for up to 60 seconds; a revoked key stops working globally within that window.
Handling keys safely
- Call the APIs from your backend. Never embed keys in browser or mobile code — anything shipped to a client is public.
- Store keys in a secret manager or environment variables, never in source control.
- Scope outbound logging: the key should never appear in your logs either.
Failure modes
| Situation | Response |
|---|---|
Missing Authorization header | 401 UNAUTHORIZED — the detail explains the expected format |
| Malformed header or key | 401 UNAUTHORIZED |
| Revoked or unknown key | 401 UNAUTHORIZED — "invalid or has been revoked" |
All error responses are application/problem+json; see Errors for the full
catalog and retry guidance.