Know who is calling

API keys

API keys are the way an app or a script should authenticate. Each key belongs to one person, can be revoked on its own, and does not depend on a browser session. They are not available yet. This page will say how to create one when they are.

Session keys

Until then, a session key covers the calls you make yourself. It comes from signing in, so it expires with that session after seven days, and signing out ends it sooner.

• Use it from a script or a server you control, not from browser code or a mobile app.
• Store it like any other credential: an environment variable or your own secret store, never a repository.
• Send it in a request header, never in a URL.

When a call is refused

A refused call usually means the credential expired, was ended by signing out, or does not belong to someone with access to that stash. Sign in again for a new session key, and check the rules on the secret.