Authentication
Bearer keys, the two kinds of key, what each key carries, and rotation.
Every customer endpoint takes an API key as a bearer token:
Authorization: Bearer sk_Ljq2ji7x…Keys are 256-bit random values with an sk_ prefix. They are shown once, on creation or rotation, and stored only as a SHA-256 hash. A lost key cannot be recovered; rotate it from the dashboard and the old key stops working immediately.
Two kinds of key
| kind | who holds it | used for |
|---|---|---|
| Site key | A developer, or a form platform on behalf of one customer form | /v1/classify, /v1/feedback, /v1/usage, /v1/submissions |
| Platform key | A form service | Everything a site key can do, plus /v1/partner/* to create and manage site keys for customer forms |
A platform key’s site keys are children of the platform key: they inherit its rate limit and, unless set, its quota, and their usage rolls up in /v1/partner/usage. A site key can only see its own data. Platform mode comes with the Platform and Scale plans; see For form platforms.
What a key carries
| setting | effect | default |
|---|---|---|
locale | Latin locales flag Cyrillic or CJK text as a soft signal | en |
honeypot_field | Name of the hidden trap field. If it is not honeypot, send the value under that name and the API reads it from there | honeypot |
site_description | One paragraph about the site; the second-opinion stage uses it to judge what a legitimate message looks like for you | empty |
retain_raw_text | Keep full submission text for review | off |
quota | Classifications per month, by plan | 1,000 |
rate_limit | Requests per minute | 60 |
Site keys are configured from the dashboard, or through the Platform API when a platform manages them.
Keep it on the server
The key must never reach a browser, a mobile app bundle or a public repository. Calls come from your backend. For a form on a static site, put a small serverless function between the form and the API.
Rotation
Rotate a site key from the dashboard, or with POST /v1/partner/keys/{id}/rotate for platform-managed keys. Rotation is immediate: the old key returns 401 from the next request. Deploy the new key first, then rotate, if you need zero downtime.