Authentication

Send the key in the X-API-Key header on authenticated operations. The API Reference identifies which operations require the scheme.

Send the key

X-API-Key: your_application_key

Security boundary

Keys belong in server-side secret storage. Do not place them in query strings, fragments, browser bundles, analytics properties, logs, or screenshots. Use separate keys for environments and applications so rotation has a bounded impact.

Separate applications and environments

Give each application and environment its own key. This keeps attribution clear and lets you rotate one integration without interrupting unrelated traffic.

Rotate deliberately

Store the replacement key before changing application configuration, verify a bounded test request, and then revoke the old key through the Dashboard. Avoid copying credentials through URLs or client-side state during rotation.

Handle rejected authentication

Treat an authentication rejection as a configuration or credential lifecycle problem. Do not retry the same rejected credential in a tight loop. Confirm the header name, secret source, and active key state, then use the documented error and X-Request-ID for investigation.

Continue with Errors and Retries & timeouts.