API Key Security Best Practices

Securing Your API

All public API endpoints require an X-API-Key header for authentication. Keys are created and managed in Admin → API Keys.

Domain Allowlisting

Each API key can optionally restrict requests to specific origin domains, preventing unauthorized usage from unknown sources.

Key Rotation

Regularly rotate your API keys and set expiration dates to minimize risk of compromised credentials.