Authentication

Every API request requires a secret key in the Authorization header:

Authorization: Bearer sk_your_secret_key

Create and revoke keys in Dashboard → Settings → API keys. The API key and its separate webhook signing secret are shown only once; Mistrounter stores a SHA-256 hash of the API key for later verification.

Security practices

• Store keys in a server-side secret manager or environment variable.
• Use a separate key per application and environment.
• Never commit keys or place them in NEXT_PUBLIC_*, VITE_*, browser, or app bundles.
• Revoke and replace a key immediately if it may have leaked.
• Do not log the Authorization header.

Missing, invalid, or revoked keys return HTTP 401 with code invalid_api_key.