Authentication
Every API request (except status checks) requires authentication. Include your API key as a Bearer token in the Authorization header. You can generate and manage API keys from your Dashboard, or programmatically via the API Keys endpoints.
Along with the API key, always send two additional headers: Accept: application/json ensures error messages come back as structured JSON instead of HTML, and Content-Type: application/json is required for any request that sends a body (POST, PUT, PATCH).
HTTP Headers
Authorization: Bearer YOUR_API_KEY
Accept: application/json
Content-Type: application/json
Keep your API key secret. Never expose API keys in client-side code, public repositories, or URLs. If a key is compromised, revoke it immediately from your Dashboard and create a new one. You can also restrict keys to specific IP addresses for additional security.
What happens when authentication fails
The API returns specific error codes so you can handle each case:
| Code | HTTP Status | Meaning |
|---|---|---|
missing_api_key | 401 | No Authorization header provided |
invalid_api_key | 401 | Key doesn't exist or has been revoked |
expired_api_key | 401 | Key has passed its expiration date |
ip_not_allowed | 403 | Request IP is not in the key's allowed list |