Documentation / Guides
Authentication
Your key, the two ways to send it, and rotating it.
One key per account, made when you sign up. It follows your plan: upgrade and the same key reads everything on the next call.
Sending it
Send it in either header:
X-API-Key: hra_live_…
Authorization: Bearer hra_live_…Never in the address. A call with ?key= is refused with a 400, because a key in a URL ends up in logs and browser history.
Keeping it safe
Keep it on your server and out of pages people load. Your account shows its first characters and copies it in full when you press Copy.
Rotating it
In your account, under Keys, Rotate makes a new key at once. The old one keeps working for 24 hours, so you can swap it in your code without a gap, then it stops.
A key we do not know gets a 401 unauthorized. See Errors.