Skip to main content

Authentication

Send your key as a bearer token:

Authorization: Bearer esk_live_1a2b3c4d_9xKp2mQ7vR4tY8wA1sD5fG3hJ6kL0nB4cX7zM9qE2rT

That is the whole scheme. There is no signature, no timestamp, no HMAC — the API is read-only, served over TLS, and a signing scheme would add ceremony without adding protection.

One exception​

GET /public-api/v1/openapi.json needs no key. An automated client has to be able to learn what it may call without already having a key, or discovery is circular — and a circular discovery story is exactly what produces the scrapers this API exists to redirect.

Keys​

  • Up to ten live keys per account. Use one per deployment, so revoking a leaked key does not take everything else down with it.
  • Rotation issues a replacement and leaves the old key working for 24 hours. An instant swap breaks every deployment using the old key the moment you click rotate, which is how people learn not to rotate.
  • Revocation is instant. Not "within a minute" — the next request with that key is refused.

If a key leaks​

Revoke it. Then look at your ledger — every credit ever granted or spent on your account is itemised there, so you can see exactly what the leak cost.

Sessions​

The developer console signs you in with a wallet signature and issues an opaque session token. It is not a JWT: revocation has to be immediate, and a JWT would have meant a signing secret to manage plus a revocation list to check, which is a session table with extra steps.

Sessions last 24 hours. "Sign out everywhere" ends all of them at once.