Every request carries a bearer token:
Get a key from the studio.
Keep it out of the browser
A key is a credential for your account. Anything that ships to a browser
ships the key with it — put it in an environment variable and call the API from
your own server.
WebSocket auth
Prefer the header, so the key never lands in a URL or an access log:
Browsers cannot set headers on a WebSocket, so a query parameter is accepted as
a fallback:
Query strings are logged by proxies and stored in browser history. Use this
only where the header is genuinely impossible, and never for a key with real
credit behind it.
When a key that looks right is rejected
Almost always a transcription error. In most fonts capital I and lowercase
l are drawn identically, and a dropped character is invisible:
Paste keys. Never retype them, and never read one off a screenshot.
