API Essentials
Authentication
Authenticate your requests and manage your API keys.
Every request needs the x-api-key header.
x-api-key: ck_live_<your-secret>Keys are minted in API Console → API Keys.
#Minting an API key
- Open the API Keys tab.
- Click Mint new key.
- Copy the raw secret. It is shown once.
The table shows the key prefix and last four characters after creation.
Allow up to 60 seconds after minting before first use.
#Revoking a key
Click the trash icon next to a key. Revocation is immediate. In-flight requests with that key fail at the next request boundary with 403 Forbidden or 401 unauthorized. Other keys on the account keep working.
#Header rules
- Header name is
x-api-key. - Send the raw secret value. No
Bearerprefix, no base64 wrapping. - Do not put the key in the URL or request body.
#Errors
403 Forbidden—x-api-keyheader missing, revoked, or not recognized. Returned by the edge with body{"message":"Forbidden"}.402 insufficient_credits— balance hit zero. Top up in the Credits tab.403 permission_denied— key is valid but the account is not eligible for the public API.
See Error Envelope for the full schema and code list.