Authentication

Every request sends your API key in the Authorization header:

Authorization: Bearer kiqa_5ePAyR…

Your key

• One key per account. Create, regenerate and revoke it in Settings → API.
• The full key is shown once, when you create it. We store only a fingerprint, so we cannot show it again; if you lose it, regenerate it.
• Regenerating or revoking stops the old key immediately. Every script, notebook or spreadsheet using it fails until you paste in the new one.

Keeping it safe

• Never put the key in a URL. URLs end up in server logs, browser history and shared links.
• Read it from an environment variable or a secrets store, not from source code you commit or share.
• Do not ship it in code that runs in someone else’s browser or a published spreadsheet.
• You are responsible for use made with your key, and we may revoke a key that is leaked or misused.

When it fails

A missing, malformed, revoked or unknown key all get the same answer, so a guessed key learns nothing:

HTTP/1.1 401
WWW-Authenticate: Bearer

{ "error": "INVALID_API_KEY",
  "message": "Send a valid API key as: Authorization: Bearer kiqa_...",
  "requestId": "req_891158e8…" }