API Authentication

Send the API key in the standard Authorization header:

Authorization: Bearer sk-your-api-key

Key practices

• Use API keys only from trusted server environments.
• Create separate keys for production, staging, and individual integrations.
• Revoke a key immediately when it may have been exposed.
• Do not include keys in URLs, logs, analytics events, screenshots, or support messages.
• A canceled Business subscription remains usable until its current paid period ends. Existing keys stop authorizing API requests after that date.
• A Trial Key is created automatically when a signed-in account starts its one-time 7-day trial. It stops authorizing requests when the trial expires or all 10 successful single-page requests have been used.

Missing, malformed, inactive, and invalid keys return HTTP 401. A valid key without an active Business subscription or active API trial returns HTTP 403.

Automation examples also send X-Integration-Source with a short value such as make, n8n, airtable, or google-apps-script. This optional header is stored with the safe API usage audit so account administrators can identify which workflow generated a request. It does not replace authentication and must not contain customer data.