Skip to main content
Every protected endpoint accepts the same header:
Two kinds of token work there, and the API treats them identically. There is no separate “API key” endpoint for anything.

​
Creating an API key

1

Sign in

Get a session token from POST /api/auth/signin:
The token is at result.token.
2

Create the key

name is optional and capped at 60 characters; omit it and the key is called Untitled key.
3

Store the secret

The response contains result.secret. This is the only time it is returned. Later calls to GET /api/auth/keys show just last_four.
An account may hold up to 25 live keys. Revoke keys you no longer use with DELETE /api/auth/keys/{id}.

​
Public endpoints

These need no Authorization header:
  • POST /api/auth/signup
  • POST /api/auth/signin
  • POST /api/auth/forgot-password
  • POST /api/auth/reset-password
  • GET /health, /healthz, /readyz
POST /api/billing/webhook is also unauthenticated in the bearer sense. It is verified instead by the webhook-id, webhook-timestamp, and webhook-signature HMAC headers, and is meant only for the payment provider.

​
Handling a 401

A missing, malformed, revoked, or expired token returns 401 with the standard error envelope:
Revocation takes effect immediately. A revoked key fails the next request.
Treat tru_ keys like passwords. Keep them in environment variables or a secret manager, never in client-side code, a repository, or a URL query string.