API reference / Authentication

Authentication

Every request to the public API (/v1/*) is authenticated with an API key passed in the Authorization header.

The Authorization header

Authorization: Bearer sb_your_key_here

Send the key as a bearer token. Keys always begin with sb_, which makes them easy to spot in logs and config.

Creating an API key requires a verified email. When you sign up we email you a verification link; until you click it, you can sign in and explore the dashboard, but creating a key returns email_not_verified (403). Open the link (or use Resend email from the banner or the API keys screen), then create your key as usual. This gate only affects key creation — generation itself is unaffected, since a key is the only credential for it.

Creating a key

Create keys from API keys in the dashboard. You can give each key an optional label (for example production or ci) to tell them apart later.

The full key is shown once, at creation. Copy it immediately and store it somewhere safe (a secret manager or environment variable). Only a SHA-256 hash and a short prefix are kept on our side, so the full key can never be displayed again.

Revoking a key

Revoking a key is immediate and permanent: the key stops authenticating on the very next request. The key record is kept (so it still appears in your list, marked revoked) rather than deleted, which preserves the audit trail. Revoking one key never affects your others.

To rotate a key with no downtime, create the new key first, deploy it, then revoke the old one.

How many keys you can have

The number of active (non-revoked) keys you can hold at once depends on your plan:

Plan	Active keys
Free	1
Starter	2
Pro	5
Scale	10

Trying to create a key beyond your plan's cap returns key_limit_reached (403). Revoke an unused key to free a slot, or upgrade your plan.

When auth fails

A missing, malformed, or revoked key returns 401 unauthorized. The four cases are intentionally indistinguishable in the response, so the API never reveals whether a given key once existed.

Keep keys server-side

API keys grant the ability to generate documents on your account, which costs quota. Treat them like any other secret:

Use them only from your backend, never in client-side code, a mobile app, or a public repo.
Store them in environment variables or a secret manager.
Use a separate key per environment (and revoke one without disturbing the others).