Authentication & Keys

How to authenticate API requests and manage your credentials securely.

Authentication model

All API requests require a bearer token in the Authorization header. Generate your API key from the dashboard and keep it secure.

Request format

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Key rotation

Rotate keys periodically and retire old keys immediately after a trusted replacement is in place. Always store keys in a secrets manager or environment variable.

Scopes and access control

API keys are scoped to the products and systems you enable in your account. Grant keys only the permissions needed for the integration.

Security best practices

  • Never store keys in source control.
  • Use separate keys for development and production.
  • Secure key storage with a vault or managed secret store.