Documentation / Guides
Authentication
Your key, the two ways to send it, and making a new one.Every call needs a key. Keys start iha_live_ and belong to your account; every key on the account shares its plan and its limits.
Sending the key
Send it in a header, either of these:
X-API-Key: iha_live_...
Authorization: Bearer iha_live_...A key in the address (?key=) is refused with bad_request, because addresses end up in logs and browser history.
Making and revoking keys
In your account, under API keys, you can make up to five, give each a label, and revoke one at once. A key is shown once, when it is made; we keep only a fingerprint of it, so it cannot be shown again. Lost a key? Make a new one and revoke the old.
In the browser
The API answers browsers from any site (CORS is open), so a key used in a web page can be read by anyone who opens it. Keep keys on a server where you can.