Authentication
All public API endpoints require an API key in the Authorization header.
Create an API key
Example request
Security recommendations
- Store API keys in a server-side secret manager.
- Use separate keys for production and local development.
- Rotate keys when employees leave or integrations are retired.
- Disable unused keys from the dashboard.
- Never put API keys in frontend code, Git repositories, screenshots, or support tickets.
Authentication errors
Invalid or missing API keys return: