Authentication
Every API request needs an API key in the Authorization header. Keys belong to your organization and spend its shared balance.
Authorization: Bearer YOUR_BASEURL_KEYCreating keys
Owners and admins create keys on the API keys page. Creating keys needs a verified email, an approved account and the current terms accepted. The full key is shown once; BaseURL stores only a hash of it and cannot show it again. If you lose a key, rotate or revoke it and create a new one.
Monthly limits and alerts
Give any key a monthly spending limit in naira, with an optional email alert at 50, 80 or 90% of it. When a key reaches its limit, its requests answer 402 monthly_budget_exceeded until the next month or until you raise the limit. Your other keys keep working.
Pausing, rotating and revoking
| Action | What happens |
|---|---|
| Pause | Requests answer 403 key_paused until you resume the key. Use it to stop a runaway script without losing the key. |
| Rotate | Creates a replacement key with the same settings. The old key keeps working for a grace period (24 hours by default) so you can update your app, then answers 401. |
| Revoke | The key stops working permanently. |
Pause, resume and revoke take effect within about 30 seconds.
Keeping keys safe
- Keep keys on your server, in environment variables. Never put a key in a mobile app, a browser script or a public repository.
- Use one key per app or environment, so you can limit, pause or revoke each one separately.
- If a key leaks, revoke it at once.
Questions? Email [email protected] with your X-Request-Id.