Skip to main content
Project API keys authenticate calls to /v1/*. They are scoped to one project and one environment.

​
Key format

The secret contains 32 bytes from a cryptographically secure random source and is encoded as base64url.

​
Send a key

Use the standard bearer header:
Malformed, unknown, revoked, and environment-mismatched keys all return 401. Raw credentials and authorization headers are never written to logs.

​
Secret handling

  • Keep keys in a server-side environment or secret manager.
  • Use a different key per service when independent revocation matters.
  • Never expose a key in browser JavaScript, mobile app binaries, logs, or support screenshots.
  • Rotate keys by creating the replacement before revoking the old one.

​
Key status

A key can be ACTIVE or REVOKED. Revocation does not delete historical usage or ledger data. The dashboard shows when a key was last used, so you can confirm traffic has moved before retiring a replacement.