Authentication

Every request is authenticated with a Bearer API key. Learn the difference between test and live keys and how errors are shaped.

Every endpoint under /v1/* requires an API key, sent as a Bearer token:

Authorization: Bearer <key>

Requests without a valid key receive 401 Unauthorized.

Key types

Prefix	Type	Behavior
`ik_test_...`	Test	Returns deterministic sample data. Never touches the live database. Never counts against your daily quota.
`ik_live_...`	Live	Returns real, current data. Counts against your plan’s daily quota.

Both key types share the exact same request/response shape — the only difference is where the data comes from and whether it’s metered. This lets you build and test integrations on a test key with zero risk, then switch to a live key for production traffic without changing any client code.

Managing keys

Keys are created and revoked from your developer dashboard, under API Keys.
A key’s raw value is shown once, at creation — only a hash is stored server-side, so it can’t be recovered later. If you lose a key, revoke it and create a new one.
Revoking a key is immediate and irreversible; requests using a revoked key start failing with 401 right away.
Your plan caps how many live and test keys you can have active at once (revoking a key frees its slot).

Error responses

Every endpoint uses the same error shape:

{
  "error": {
    "type": "unauthorized",
    "message": "Missing or invalid API key. Send \"Authorization: Bearer <key>\"."
  }
}

Type	HTTP status	Meaning
`unauthorized`	401	Missing, malformed, or revoked API key.
`invalid_request`	400	A parameter was invalid — e.g. an unknown `event_type`.
`server_error`	502	Something failed on our side while fetching data.

See Errors for the full list and how to handle each case.