Skip to main content
Send your key as a bearer token on every request:
Anything else — a missing header, a malformed token, an unknown key, or a revoked one — returns 401 invalid_api_key. The response is deliberately identical in all four cases, so an unknown key can’t be distinguished from a revoked one.

​
Scope

A key belongs to one person and one team. That has two consequences:
  • Usage bills to that team’s monthly credits.
  • If your membership of the team ends, the key stops working and calls return 403 membership_ended. Create a new key from your new team.
Keys are private. Teammates and admins can’t see or revoke each other’s keys — the only ways a key dies are the owner revoking it, or the owner being removed from the team.

​
Rotating

There’s no rotate operation. Create the new key, deploy it, then revoke the old one from Settings → API. Revocation takes effect immediately. lastUsedAt in the key list tells you whether an old key is still in use before you revoke it. It’s throttled to one write every five minutes, so it lags by up to that long — treat “used in the last five minutes” as “still in use”.

​
Keeping keys secret

The key is equivalent to read access to your team’s Spyglass data and can spend your credits. Treat it like a password:
  • Keep it server-side. There’s no CORS, so it can’t be used from a browser anyway — but that also means a key in frontend code is leaked for nothing.
  • Put it in an environment variable, not source control.
  • If one leaks, revoke it. That’s instant and can’t be undone.