x-api-key header.
401:
Keep your key secret
- Call the API from your server, never from a browser or a mobile app where the key can be read.
- Keep the key in an environment variable or a secret manager, not in source control.
- If a key leaks, tell us and we will revoke it and issue a new one.