Authentication
Every request carries a key, and a key reaches only the tools you grant it.
Authentication
Send your key in the X-API-Key header, or as Authorization: Bearer <key>. Either works — don't send both. Create and revoke keys on the API Keys page.
X-API-Key: kri_live_...
A key reaches only the tools you grant it
Keys authenticate the tool endpoints and nothing else — account, billing, webhook and key management all need a signed-in session, so a leaked key can't change your account, buy credits or mint more keys.