Docs · Getting started

Authentication

Authenticate every request with a Bearer token. Sign-up, login and password reset are the only public endpoints.

Header

Authorization: Bearer tk_live_51Hq...

Token types

TokenLooks likeUse it for

Live keytk_live_…Production traffic from your server

Test keytk_test_…Building and automated tests. No real messages, no credits used

JWTeyJhbGci…Dashboard and browser sessions, from POST /v1/auth/login

Keeping keys safe

Warning: Treat live keys like passwords. Never ship them in a mobile app, a website or a public repository.

If a key leaks, regenerate it straight away with POST /v1/developer/keys/{type}/regenerate. The old key stops working immediately, so update your servers first.

Two-factor authentication

Dashboard users can turn on 2FA. Logins then return requires_2fa: true and need a code sent to POST /v1/auth/2fa/verify. API keys are not affected.

Missing or wrong key · 401

{
  "error": {
    "type": "authentication_error",
    "code": "invalid_api_key",
    "message": "The API key provided is not valid.",
    "request_id": "req_2Lx8pQ0aVz"
  }
}

Use a tk_test_ key while you build. Nothing is sent and no credits are used.

Was this page helpful?