Authentication
Your key, the two ways to send it, and rotating it.
On this pageSending your keyYour keyRotating
Sending your key
Send it in a header, one of these two:
X-API-Key: YOUR_API_KEY
Authorization: Bearer YOUR_API_KEY
A key in the address (?key=) is refused with a 400, so it never lands in a log.
Your key
One key per account, made when you sign up. It follows your plan: change plan and the same key reads what the new plan allows on its next call. We keep only a fingerprint of it, so a lost key cannot be shown again.
Rotating
Rotate from your account. You get a new key at once, shown one time; the old one keeps working for 24 hours, so your code can switch without a gap.