Authentication

Sending your key, keeping it safe and rotating it.

Sending your key

Every call carries your key in a header. Either works:

Authorization: Bearer tvs_live_...
X-API-Key: tvs_live_...

A key in the address (?key=) is refused with bad_request, so keys never land in logs and browser histories.

Where your key lives

Your keys are on your account. We keep a fingerprint to check each call and an encrypted copy so you can show it again; nobody else can see it. Keep it on your server or in your app's secrets, never in a public page or repository.

Rotating

Rotate makes a new key at once. The old one keeps working for 24 hours, so a deploy is never broken mid-day, then stops. Rotate whenever a key may have been seen.

One key, your plan

The plan is read from your account on every call, never from the key. Upgrade and the same key reads the new plan on its next call. Complete gives 5 keys, for separate apps or environments.