Authentication

API keys

Authenticate customer API requests with Authorization: Bearer re_…. Keys belong to one workspace and must never be embedded in browser, mobile, desktop, template, or email content.

Authorization: Bearer re_your_key_here

Browser sessions

The dashboard uses an HTTP-only, revocable session cookie. Billing changes and API-key creation or revocation require this browser session and are not available to bearer keys. A bearer key can read the same account, usage, and billing state through GET /account, dashboard analytics through GET /analytics, and key metadata (name, prefix, last use) through GET /keys.

Rotation

1. Create a replacement key from an authenticated dashboard session.
2. Deploy the replacement to every calling service.
3. Confirm traffic uses the new prefix.
4. Revoke the old key.

Authentication failures

A missing, expired, revoked, or unknown credential returns 401 using the standard error envelope. Do not retry authentication failures automatically.

{
  "error": {
    "message": "Unauthorized — provide a valid API key or session",
    "status": 401
  }
}