Skip to main content
Every request carries a bearer token:
Get a key from the studio.

​
Keep it out of the browser

A key is a credential for your account. Anything that ships to a browser ships the key with it — put it in an environment variable and call the API from your own server.

​
WebSocket auth

Prefer the header, so the key never lands in a URL or an access log:
Browsers cannot set headers on a WebSocket, so a query parameter is accepted as a fallback:
Query strings are logged by proxies and stored in browser history. Use this only where the header is genuinely impossible, and never for a key with real credit behind it.

​
When a key that looks right is rejected

Almost always a transcription error. In most fonts capital I and lowercase l are drawn identically, and a dropped character is invisible:
Paste keys. Never retype them, and never read one off a screenshot.