Authentication

Server-to-server only

Developer keys are designed for backend services only.

• Do not use keys in browser code.
• Do not expose keys in client bundles.
• Do not embed keys in mobile app binaries.

Header format

Send your key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

X-API-Key: YOUR_API_KEY works too, but prefer Authorization: Bearer.

Access restrictions

• Only GET is allowed for key-based requests.

API key rate limits

• Developer keys use a dedicated rate-limit bucket.
• Current limits: 20 requests per 60 seconds and 1,000 requests per 24 hours.
• This bucket is separate from session-authenticated dashboard traffic.

Key lifecycle

• One active key per user account.
• Revoke and rotate keys from your profile.
• Rotating immediately invalidates your previous key.

Example request

curl -X GET "https://slowstack.tv/api/v1/players?limit=20" 
  -H "Authorization: Bearer YOUR_API_KEY"

Security recommendations

• Keep keys in a secret manager.
• Rotate immediately if a key leaks.
• Never commit keys to Git.