Authenticating requests

All requests must include an Authorization header with a bearer token. Keys are scoped to your account and plan quota.

Header format

Authorization: Bearer bk_live_51H8x2K...

Key rotation

Revoke and regenerate keys anytime from Dashboard → API. Revoked keys stop working immediately; requests already in flight are not interrupted.

Rate limits

Every response includes X-RateLimit-Remaining and X-RateLimit-Reset headers so you can back off before hitting your quota.