Security
Authentication
Every call carries your API token in the Authorization header.
Authorization: Bearer prj_live_...Headers
| Header | Value | Required |
|---|---|---|
Authorization | Bearer prj_live_... | Yes |
Accept | application/json | Recommended |
Content-Type | application/json | Yes, when the call has a body (POST) |
Idempotency-Key | a unique code per request (UUID) | Yes, on Generate keys |
The token
- It starts with
prj_live_and is 49 characters long. - It only works in the
Authorizationheader. Do not send the token in the URL (?token=) or in the body. - It can have an expiration (30 days, 90 days or 1 year) or none. You choose when creating it.
- Each account can have up to 10 active tokens.
- A deleted or expired token gets
401. Create another one in the panel.
Authentication responses
| HTTP | When |
|---|---|
401 | Missing header, or an invalid, deleted or expired token. |
403 | The token is valid, but lacks the permission for that endpoint. |
{
"success": false,
"message": "Este token não tem permissão para esta ação (precisa de \"keys:generate\").",
"errors": { "required_scope": "keys:generate" }
}If the token leaks
Delete the token in the panel: it stops working immediately. Then create another one and replace it on your server. Do not share tokens in repositories, screenshots or chats.