Getting started
Authentication
Use your dashboard API key to authenticate public API requests. Create one from Dashboard → API Keys and send it as a bearer token. X-API-Key: <key> also works, as an optional secondary header.
header
Authorization: Bearer papi_live_4f8a…Key format
Keys start with a visible prefix (papi_live_) followed by a 32-character secret. The full key is shown once at creation — store it in your secret manager immediately. The dashboard only ever displays the prefix and the last four characters afterwards, because only a hash of the key is kept.
Keep keys server-side. Never ship an API key in browser or mobile code. Proxy requests through your backend — in Next.js, call the API from a server action.
Unauthenticated requests
A missing key returns 401 with error code API_KEY_MISSING; an invalid key returns 401 API_KEY_INVALID; a revoked key returns 403 API_KEY_REVOKED. See Errors.