Skip to main content

API keys

One key per account​

Each account, identified by its email address, has exactly one active API key. The key carries the limits of your current plan: when you buy Premium, the same key gets the Premium limits.

Keys start with sk_live_ followed by a long random string. How to send the key is in Authentication.

Shown once​

We never send keys by email and we never store them. We store only a one-way hash, which is enough to recognize the key but not to show it again.

  1. After you sign up or pay, we email you a one-time link. It works once and expires after 24 hours.
  2. Open it and click Reveal my API key. The key is shown on that page, once.
  3. Copy it into your server's environment variables or a secrets manager. If you refresh or leave the page, it is gone.

If the link was already used or has expired, request a new one as described below.

Signing up again with the email of an account that already has a key doesn't create a second key: we only email you a notice. Use Lost your key? instead.

Lost or leaked key​

  1. Click Get API key at the top of the page, then Lost your key?, and enter your account email.
  2. If an account exists, we email you a one-time link (valid 24 hours).
  3. Revealing the new key immediately revokes the old one. Update your servers right away.

Until you click Reveal on the new link, your current key keeps working. If you didn't ask for a new key, ignore the email.

To protect inboxes from abuse, we send at most one of these emails per account every 5 minutes. If the email hasn't arrived, check your spam folder and wait a few minutes before asking again.

Rotate the key the same way if it may have been exposed, or when someone with access leaves your team.