Authentication

Every request is authenticated with an API key — there is no OAuth flow, session cookie, or username/password on the API itself.

Where a key is created

Keys are created from your account's dashboard, on the API Keys page, after you register and sign in. Each key can be scoped to only the capabilities an integration needs — see API Keys.

Required header

Send the key in the X-API-Key header on every request:

X-API-Key: YOUR_API_KEY

Authentication failures

A missing, invalid or revoked key is rejected before the request reaches any calculation logic. See Errors for the exact status codes.

Key security

• A key's secret is shown exactly once, at creation. It cannot be retrieved again — if you lose it, revoke it and create a new one.
• Never commit a key to source control or expose it in client-side (browser/mobile) code — call the API from your own server.
• Scope each key to only what it needs, so a compromised key has limited reach.

Revocation

Revoke a key instantly from the API Keys page in your dashboard. Revocation takes effect immediately — any request using that key is rejected from that point on.