Authentication

Bearer Token

All external API requests use bearer authentication:

Authorization: Bearer sk_live_...

Create the API key from Settings -> API Keys.

Key Lifecycle

• Full API keys are displayed only once at creation time.
• The platform stores only a hash and a short prefix.
• Deleting an API key immediately revokes access.
• Keys can be given scopes, an expiration time, and a request-per-minute limit.

Common Errors

• invalid_api_key
• scope_not_allowed
• rate_limit_exceeded
• api_disabled