Authentication

Every request authenticates with an API key sent as a Bearer token. Live keys are prefixed sk_live_, test keys sk_test_.

Sending your key

Provide an Authorization: Bearer header on every request. A missing or unrecognized key returns 401 with a machine-readable error code (missing_api_key / invalid_api_key).

Creating a key

Create and roll API keys from your dashboard. Keep secret keys server-side; never ship them in a browser or mobile bundle.

Rate limits

Each key has a per-window request ceiling. Exceeding it returns 429 with X-RateLimit-* headers; a 429 does not debit credits.