Authentication
Creating API keys, sending them, and keeping them safe.
API keys
Every call needs an API key in the x-api-key header:
curl -H "x-api-key: $API_KEY" "$API_URL/v1/youtube/channel?handle=MrBeast"Create keys under API keys in the dashboard. A key is shown once, when it's made: copy it then. Name each key after the app or script that uses it, so the Usage page tells them apart.
A missing, wrong or revoked key answers 401 UNAUTHORIZED.
Keeping keys safe
- Keep keys on your server, in environment variables or a secrets manager. Never put one in a browser, a mobile app or a public repository: anyone with a key can spend your credits.
- Use one key per app or environment, so revoking one doesn't stop the others.
- To replace a key, create the new one, deploy it, then revoke the old one. A revoked key stops working at once.
Keys belong to a workspace, and its credits and rate limit are shared by all its keys. See Credits.