Authentication
Every request under /api/v1 must include an API key in the X-API-Key header.
Required header
X-API-Key: fna_live_••••••••.••••••••••••••••••••Never send a key in the URL. Query strings are commonly recorded by browsers, proxies and monitoring tools.
Recommended storage
- Server-side environment variable
- Platform secrets manager
- Never in Git or a client bundle
Lost secret
The dashboard cannot display a lost secret again. Create and deploy a new key, then revoke the old one.
Error responses
| Status | Cause |
|---|---|
401 | Missing or invalid key |
429 | Minute or monthly quota reached |