Skip to main content

​
Get a key

Create one in the console under Settings → API keys. The key is shown once, when it is created — copy it then. If you lose it, revoke it and create another. Keys look like this:
Treat one like a password: keep it in an environment variable, never in client-side code or a public repository. These are server keys — the API is not designed to be called from a browser.

​
Send it

Every request to /v1/* carries the key in an Authorization header:

​
When a request is refused

A missing, malformed, unknown, revoked or expired key all return the same response:
They are deliberately indistinguishable. If a request you expect to work is refused, check the key’s status in the console rather than reading anything into the response.

​
Rate limits

Each key carries its own request budget. See Rate limits.

​
Revoking and expiry

Revoking takes effect immediately — the next request with that key is refused. A key with an expiry stops working the moment it passes, with no warning to the caller, so set a calendar reminder if you use one. Revoked keys stay listed in the console with their last-used date, so you can tell whether anything was still calling with a key before you removed it.