Every request must carry your API key in the x-api-key header.
A request without a valid key gets 401:

Keep your key secret

  • Call the API from your server, never from a browser or a mobile app where the key can be read.
  • Keep the key in an environment variable or a secret manager, not in source control.
  • If a key leaks, tell us and we will revoke it and issue a new one.