An API key authenticates every request as a Bearer token (see Authentication).
Keys come in two classes:
The management endpoints on this page require an Admin key (or the account owner signed
in to the dashboard). A Usage key calling them is rejected.
Managing keys
The full key lifecycle is API-callable, so you can issue a key per customer from your own
onboarding flow rather than working through the dashboard.
Creating a key
The response is a ClientKey carrying the new ApiKey secret. Store it when you receive it.
Key creation is subject to your plan’s active-key cap.
Rotating a key
Regeneration carries the key’s reference, expiry, type, parallelism, fairness weight, and
allowed origins forward onto the new secret.
The old secret stops working immediately — there is no overlap window. Update the
integration with the returned key as part of the same operation.
Revoking a key
To check a key you already hold — validity and expiry — see
Identity & key status.
Browser origins (CORS)
For a key used from a browser, restrict which origins may call the API with it. Origins
are matched exactly — scheme, host, and (non-default) port must all match.
For local development add your dev server’s exact origin, e.g. http://localhost:3000 —
http://localhost:3000, https://localhost:3000, and http://localhost:5173 are all
distinct.
Keep long-lived keys server-side. Never ship an unrestricted key in browser or mobile code.
