Get started
API keys
How keys behave, how to keep them safe and what can fail
Every request carries a key in the Authorization header. Learn more under API reference > Authentication.
Warning
- Treat a key like a password. It grants full access to the project.
- Server-side only. Call the API from your backend, never from a browser or a mobile app.
- Out of source control. Keep keys in environment variables or a secret manager.
- Rotate cleanly. Create a new key, deploy it, then revoke the old one.
- If a key leaks. Revoke it straight away and tell us at [email protected].
Shown once, revoked for good
The full key is shown once at creation and cannot be shown again, so copy it into your secret manager straight away. Keys never expire; they stop working only when you revoke them, which takes effect immediately.
What can fail
A bad or revoked key returns 401 UNAUTHORIZED. Beyond that, every error shape is described in API reference > Errors.
403PROJECT_SUSPENDEDWhen the project is suspended for negative balance; see Concepts > Limits and pricing. Topping up reactivates it.