Authentication

Overview

Managed API keys use bearer tokens. Create a key in the customer console, store it securely, and send it in the Authorization header for every /v1 request.

A Managed API key must belong to an active customer. Keys are shown only once. If a key is exposed, rotate it or create a replacement immediately.

Request format

Send requests over HTTPS and include a JSON content type unless the endpoint is explicitly multipart. Managed developer uploads and submissions are under /v1/uploads and /v1/submissions; /app/api is the browser cookie and guest-session surface.

• Authorization: Bearer YOUR_API_KEY
• Content-Type: application/json
• Idempotency-Key: reuse the same value for a retry of POST /v1/submissions

Rotation

• Replace the configured secret atomically before rotating a production key.
• A rotation invalidates the previous key immediately; there is no overlap window.
• Organization, monthly reconciliation, and invoicing are not available in the current Developer API.