Authentication

Your key, the two headers that carry it, and rotating it.

Every call needs your key. Send it in one of two headers:

X-API-Key: hruk_live_...
Authorization: Bearer hruk_live_...

A key in the address (?key= or ?api_key=) is refused with a 400 bad_request, so keys never end up in logs and browser histories.

One key, following your plan

Your account has one key. The plan is read from your account on every call, so an upgrade reaches further on your very next call with the same key.

Rotating

Rotate makes a new key on your account page. The old key keeps working for 24 hours, so a deploy is never broken mid-day. The new key is shown once; it is also kept in this browser for these docs.

In the browser

The API answers this site's own pages from the browser. For your own front end, call the API from your server so the key stays private.