Authentication

Every request carries an API key in the Authorization header.

Authorization: Bearer kd_your_api_key

Key format

Keys start with kd_. After creation the dashboard shows only the first characters, so you can tell keys apart without exposing them.

Keeping keys safe

• –Never put a key in browser code, mobile apps or public repositories. Anyone who can read it can spend your credits.
• –Keep keys in environment variables or a secrets manager.
• –Use one key per app or environment, so you can revoke one without breaking the rest.
• –Revoke a key as soon as you suspect it leaked, then create a new one.

Authentication errors

A missing, malformed or revoked key returns 401 invalid_api_key. A valid key on an account without approved access returns 403 access_not_granted.