API Keys

Key format

Every public API key starts with key_.

How auth works

Send your key in the Authorization header:

Authorization: Bearer key_xxx

What your dashboard shows

Your dashboard key cards expose:

• key preview
• status
• package type
• credits used and remaining
• request counts
• install commands for Windows and Linux/macOS

Key status

• ACTIVE — usable
• EXPIRED — no longer usable
• REVOKED — permanently disabled

Best practices

• Keep one key per environment
• Rotate keys when a teammate leaves or a secret leaks
• Never put keys in frontend code
• Never pass keys in query parameters