X-API-Key header, plus a real User-Agent header.
401:
GET /health is the only endpoint that works without a key.
Managing keys
- Create and revoke keys under API keys in your account.
- Use one key per app or workflow, so you can revoke one without breaking the others.
- A revoked key stops working within about 30 seconds.
Keep your key safe
- Call the API from your server or workflow tool, not from a browser or a mobile app.
- Store the key in an environment variable or a secrets manager, never in your code.
- If a key leaks, revoke it and create a new one.