Authentication

Send the API key in the header

Every API is authenticated with an API key. Set these headers:

Authorization: Bearer ks_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

• There is one space between Bearer and the API key.
• The request body is JSON, encoded as UTF-8.
• HTTPS only.

If the API key is wrong, disabled, deleted or expired, the API returns HTTP 401:

{"code": 401, "msg": "API Key 无效或已停用", "data": null}

For security, the API does not say which of these it is. Check the key in the console.

Manage API keys

In Console · API keys you can:

• create several API keys, for example one for testing and one for production;
• rename API keys so you can tell them apart;
• delete API keys you no longer use — they stop working immediately.

Which key each call used and how much it cost are shown under Usage and Bills in the console.

Keep your API key safe

• Keep it on the server only (environment variables or config files). Never put it in browser or app code, and never commit it to a code repository.
• If you think a key has leaked, delete it in the console right away and create a new one.