Authentication.

Treat it like a password

It is a shared secret, not a public identifier. Keep it on a server, in an environment variable, out of version control, and never in browser JavaScript, where anyone can read it.

Building a web UI? Put a route handler on your own server that holds the key and forwards the request. That is exactly how the playground on this site works: the browser talks to our server, our server talks to the API, and the key never reaches the page.

What is open

Everything under /v1 needs the key, except /v1/health. The interactive /docs and /openapi.json are also open, the endpoints are documented publicly even though calling them is not.

When it fails

Neither response reveals whether a key is configured on the server, and comparison is constant-time, so a wrong key gives away nothing about the right one.

The most common cause of a rejected key that looks correct is a trailing newline or a pair of quotes picked up when pasting it into a dashboard field.

Getting a key

Ask, with a sentence about what you are building.