Authentication

API keys, request headers, and how to keep credentials out of client bundles and public repositories.

All protected API routes require an API key. Pass it as X-API-Key, or as a Bearer token in the Authorization header.

Accepted headers

X-API-Key: your_api_key_here
Authorization: Bearer your_api_key_here

Getting your API key

Sign in. Open the Dashboard with an authenticated account.
Open API Keys. Go to /dashboard/keys.
Create a key. Choose a descriptive name and confirm creation.
Copy and store. Save the secret immediately. It is not shown again.

Treat API keys like passwords. Never commit them to git, never ship them in browser JavaScript, and rotate them when people leave a project.

Example request

cURL

curl -X POST /api/v1/execute/hash-text \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input":{"algorithm":"sha256","text":"hello"}}'

Error responses

HTTP 401

{
  "status": "error",
  "code": 401,
  "error_code": "unauthorized",
  "message": "Invalid or missing API key"
}

Common 401 causes: missing header, truncated key, revoked key, or mixing environments. Fix by creating a fresh key in the dashboard and updating your secret store.

Best practices

Store keys in environment variables or a secrets manager.
Use separate keys for local development, staging, and production.
Revoke compromised keys immediately from the dashboard.
Prefer the server SDK or backend proxy when calling tools from web apps.