Authentication

Every request carries a key as a bearer token:

Authorization: Bearer sfk_live_<32 characters>_<6 character checksum>

The trailing checksum lets an obviously malformed key be rejected without a database lookup, and gives secret scanners something to match on.

Keeping a key safe

• Server-side only. There is no CORS, so a browser call cannot work.
• We store a one-way hash — a lost key cannot be recovered, only rolled.
• Rolling issues a replacement immediately and keeps the old key working for seven days, so you can deploy without an outage.
• Revoking stops a key on its very next request, with no cache to wait out.
• Optional IP allowlist per key. With none set, any address may use it.

What a key can never do

Regardless of scopes: manage billing, reach platform administration, create or revoke API keys, read or set passwords, or create an Owner or Admin account. Key management is deliberately UI-only, so a leaked key is a bounded, revocable read rather than a permanent foothold.