Authentication
Send your API key in the Authorization header. How keys work, how to rotate them, and how to keep them safe.
Every request needs an API key. Send it in the Authorization header:
Authorization: Bearer vq_live_abc123def456_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
If your HTTP client makes custom Authorization headers awkward, you can send the same key as X-API-Key: vq_live_... instead.
Creating keys
Create keys in the dashboard under API keys. Give each one a name you'll recognise later, like "Production signup" or "Staging".
- A key is shown once. We store only a fingerprint of it, so we can't show it again. If you lose it, create a new one and revoke the old one.
- You can have up to 20 active keys. Use one per app or environment, so you can revoke one without breaking the others.
- All keys on an account share one credit balance.
Keeping keys safe
- Call the API from your server, never from a browser or mobile app. Anyone can read a key that ships in client-side code.
- Keep keys in environment variables or a secrets manager, not in your repository.
- If a key leaks, revoke it right away. Revoked keys stop working instantly.
Errors
| HTTP | error.type |
What happened | Fix |
|---|---|---|---|
| 401 | missing_api_key |
No key in the request. | Add Authorization: Bearer vq_live_.... |
| 401 | invalid_api_key |
The key is malformed, unknown or revoked. | Copy the key again, or create a new one. |
| 403 | account_suspended |
The account is suspended. | Contact us. |
AI agents and OAuth
MCP clients such as Claude can connect with OAuth instead of a key: you sign in and approve access, and no key is copied anywhere. See MCP server.