Authentication

Bearer keys

Send the key in the Authorization header:

header

Authorization: Bearer cons_...

Keys belong to an account, and usage under any of an account's keys counts toward the same rate limits, concurrency cap and monthly CPU allowance.

Managing keys

Create and revoke keys on the API keys page. An account can have up to 10 active keys.
A new key is shown once. It isn't stored, so copy it when you create it.
Revoking a key takes effect on the next request. Requests using it get 401.

Keep keys on the server

A key in browser code or a public repository can be used by anyone, and you're responsible for usage under your keys.

Checking a key

GET /v1/limits needs a key and doesn't count against the rate limit, so it's a cheap way to check one. It returns your plan and where you stand on each limit.

shell

curl -sS https://api.cons.stneto.dev/v1/limits \
  -H "Authorization: Bearer $CONS_KEY"

When it fails

A missing, malformed, unknown or revoked key gets 401 with error type unauthorized:

401 Unauthorized

{
  "error": {"type": "unauthorized", "message": "this API key was revoked"},
  "request_id": "req_..."
}