Authentication
Send your key as a Bearer token on every request.
Send your key on every request
Put your key in the Authorization header as a Bearer token.
Header
Authorization: Bearer $KREATORSFACTORY_API_KEYCreate keys in the console, under API Keys. Each key is shown once, when you create it. We keep only a fingerprint of it, so nobody can read it back later, us included; if you lose one, revoke it and create another.
Keep your key on your server
Your key spends your balance. Call the API from your own server only, never from browser or mobile code, where anyone can read it. Store it in an environment variable, not in your code.
Revoking is immediate
A revoked key stops working on its next request. Rotate by creating the new key, deploying it, then revoking the old one.
When the key is wrong
A missing, unknown or revoked key gets 401 with code unauthorized.
401
{ "error": { "code": "unauthorized", "message": "Invalid API key." }}