Authentication

Send the key

Put the key in the Authorization header of every request:

Authorization: Bearer oush_…

Make and revoke keys

Make keys on the member portal's Keys page. A key starts with oush_ and is shown once: we keep only a hash of it, so we cannot show it again.

Your plan sets how many keys you may have. To replace a key, make the new one first, move your app to it, then revoke the old one. A revoked key stops working at once.

Keep keys secret

Call the API from your server. Never put a key in a web page, a mobile app or a public repository: anyone who has it can use your plan.

A missing, unknown or revoked key answers 401 unauthorized. The answer never says which.