Docs / Shared / Authentication

Authentication

One page, shared by every dataset. Send your key as a bearer token on every request.

Authorization: Bearer sk_live_7f3c…      // required, on every request

// 401 unauthorized  — missing, malformed or revoked key
// 403 forbidden     — key valid, but your plan does not include this dataset
// 429 rate_limited  — see Retry-After and X-RateLimit-Remaining

A rejected request carries WWW-Authenticate: Bearer, so a standard HTTP client reports it as an authentication failure rather than an opaque 401.

Keys

sk_live_Production keys. Count against your plan's quota and rate limit.
sk_test_Not issued yet. Test keys will return fixture data and never be billed; today every key is a live one.
StorageWe hold a SHA-256 digest of your key, never the key itself. Nobody at softon.dev can read it back to you — if you lose it, issue a new one.
TransportHTTPS only. A request over plain HTTP is rejected, not redirected — a redirect would have already leaked the key.
RotationKeys are revoked immediately when deleted. Issue the replacement first, then delete.
← All datasets