Authentication
API keys, scopes and handling them safely.
Authorization
AuthorizationheaderstringrequiredBearer inj_... — a key from Dashboard → Developer. Treat it like a password.
Keys look like inj_ followed by 32 random characters. We store only a SHA-256 hash, so a key is shown exactly once when you create it.
Scopes
| Scope | Allows |
|---|---|
| read | All public GET endpoints, plus /me, /me/key, /me/links and /me/notifications. |
| analytics:read | /users/{handle}/stats for your own profile and /me/analytics. |
| profile:write | PATCH /me/profile. |
| links:write | Add, edit and remove links. |
| social:write | Create and delete Social posts. |
Keys can also expire, be paused, and be limited to a list of IP addresses. Set all of this in Dashboard → Developer.
Rules
- Send keys only in the
Authorizationheader. Keys in URLs are refused, because URLs end up in logs, history and referrers. - Requests must use HTTPS in production.
- Revoking a key in the dashboard takes effect on the next request.
- Repeated requests with invalid keys from one IP are temporarily blocked.
Important:Never put a key in browser JavaScript, a mobile app bundle or a public repository. Call the API from your own server.
still stuck? try troubleshooting or open a ticket in our discord, we reply fast.