Getting started

Authentication

Every request carries your API key as a bearer token.

Sending your key

Authorization: Bearer pe_live_your_key_here

Generate one under API Key. New accounts start without a key — nothing is issued until you ask for it.

Shown once

Copy your key into your secret manager the moment it appears. It is displayed exactly once and cannot be retrieved afterwards — if you lose it, the fix is to regenerate, not to look it up.

Treat it like a password: keep it on your server, and never ship it in browser or mobile code where anyone can read it. Keys start with pe_live_, so most secret scanners will flag one that lands in a commit.

What your key can do

A key reads the prompts on your engines. That is all it can do — it cannot change your account, your billing, or your keys. If one leaks, regenerate it and the old one stops working; nobody can lock you out of your account with it.

A request without a valid key gets a 401, whatever else it carries:

json

{
  "success": false,
  "data": null,
  "error": {
    "status": 401,
    "message": "Missing credentials. Send your API key as: Authorization: Bearer <key>"
  }
}

Rotating without downtime

You hold one key at a time. Regenerating issues a new one and keeps the old one working for 72 hours rather than cutting it off immediately, so services already running keep working while you roll the new key out.

The sequence that avoids any gap:

1.Regenerate. You now have a new key, and 72 hours on the old one.
2.Deploy the new key everywhere it's used.
3.Confirm traffic is healthy.
4.Revoke the old key, or let it expire on its own.

Regenerating again while an old key is still in its window ends that one immediately, so you never accumulate forgotten credentials.

You always have a working key

There is no way to delete your current key on its own — regenerating always issues its replacement first. No sequence of actions leaves your account without one.

When a key stops working

A key that has been regenerated past its 72-hour window, or revoked, returns Invalid or expired API key. So does a key that was never valid. If you see this, generate a fresh one under API Key and deploy it.