Skip to main content

​
What is this?

Every request is authenticated with an API key that belongs to a user. Requests act with that user’s permissions, so a key can never do more than its owner could do in the app.

​
What can I do here?

  • Generate, regenerate, and revoke your API key in the Developer Portal
  • Authenticate requests with the X-API-Key header or a bearer token
  • Understand what each API family requires

​
How to use it

​
Create an API key

  1. Open the profile menu and choose Developer.
  2. In the API Keys panel, click Generate API Key.
  3. Copy the key and store it somewhere safe.
The raw key is shown only once and can’t be revealed again — keys are stored hashed. If you lose it, click Regenerate API Key (this replaces the old key) or Revoke to remove access.

​
Send the key

Send the key in one of these headers:
API keys are not accepted in the query string or the request body, because those leak into logs, proxies, and referrer headers. Always use a header.

​
What each API needs

​
Troubleshooting / Technical Notes

  • 401 — Missing or invalid API key. Send the key in the X-API-Key or Authorization: Bearer header. Keys in the query string or body are ignored.
  • Too many failed attempts. Invalid keys are limited per IP address before authentication even runs — see Rate limits.
  • I lost my key. Use Regenerate API Key in the Developer Portal. The old key stops working immediately.
  • I can’t open the Developer Portal. You need the API Access permission (settings:api). Documentation stays browsable without it, but generating keys and trying requests do not.
Last modified on September 20, 2026