Docs / Shared / Authentication

Authentication

One page, shared by every dataset. Send your key as a bearer token on every request.

Authorization: Bearer sk_live_7f3c…      // required, on every request

// 401 unauthorized  — missing, malformed or revoked key
// 403 forbidden     — key valid, but your plan does not include this dataset
// 429 rate_limited  — see Retry-After and X-RateLimit-Remaining

A rejected request carries WWW-Authenticate: Bearer, so a standard HTTP client reports it as an authentication failure rather than an opaque 401.

Keys

sk_live_Production keys. Count against your plan's quota and rate limit.
sk_test_Not issued yet. Test keys will return fixture data and never be billed; today every key is a live one.
How manyAs many as you need. There is no per-plan limit on keys and nobody approves them — create, name and switch them off from your dashboard, and a new one is live within about 30 seconds. Requests are counted per account rather than per key, so a second key costs you nothing and lets you scope and rotate one server at a time.
StorageWe hold a SHA-256 digest of your key, never the key itself. Nobody at softon.dev can read it back to you — if you lose it, issue a new one.
TransportHTTPS only. A request over plain HTTP is rejected, not redirected — a redirect would have already leaked the key.
RotationIssue the replacement first, deploy it, then revoke the old key from your dashboard. Revoking takes effect within about 30 seconds and cannot be undone — nothing is ever deleted, so a revoked key stays listed and its usage stays attributed to it.
← All datasets