Authenticate with an API key. Create, roll, and revoke keys in Settings → API Keys. Keys start with fw_.

A new key is read-only: it can make GET requests (and the few POSTs that only read, such as exports) and revoke itself, and gets 403 on anything else that creates, changes or deletes. Choose Full access when you create the key if your app needs to write. Existing keys keep the access they were created with.

Send the key in the Authorization header. Prefer the RFC 6750 form:

Authorization: Bearer fw_…

A raw key with no scheme (Authorization: fw_…) is also accepted, so existing clients keep working.

Treat keys like passwords. Do not commit them, put them in client-side code, or share them. HTTPS is required; unauthenticated requests fail with 401.

API keys are rate-limited to 200 requests per minute per key. A 429 includes a Retry-After header when available — back off exponentially.