Every request to https://api.descriptorapi.com/v1 needs an API key. Send it in the Authorization header as a bearer token:
Authorization: Bearer dk_live_…
If your HTTP client makes custom authorization headers awkward, the X-API-Key header works too:
Managing keys
- Keys start with
dk_live_ and are shown once, when you create them. We store only a hash, so we cannot show a key again; create a new one instead.
- Create separate keys for each environment or service, so you can revoke one without touching the others. Rate limits apply per key.
- A revoked key stops working within a few seconds.
Keep keys on the server
Call the API from your backend, never from a browser or mobile app, where anyone could read the key. If a key leaks, revoke it and create a new one.
When authentication fails
A missing, invalid or revoked key, or a suspended account, returns 401 with the error code unauthorized. See Errors.
Try it
Runs through the playground, no key needed