API Keys
All API requests are authenticated using an API key passed in theX-API-Key header.
Creating keys
Create API keys from the dashboard or via the Create Key endpoint. Each key:- Is tied to a specific team
- Can have an optional expiration date
- Is shown in full once at creation — only the prefix (
cuttr_a1b2...) is stored after that - Is hashed with SHA-256 before storage — we never store your raw key
Key lifecycle
Revoking a key is irreversible. If you suspect a key is compromised, revoke it immediately and create a new one.
Authentication flow
When you make a request, the API:- Checks the
X-API-Keyheader is present - Hashes the key and looks it up in the database
- Verifies the key is not revoked or expired
- Checks that the team has an active billing account with sufficient balance
- Checks the per-key rate limit (60 requests/minute)
- If all checks pass, the request proceeds
Error responses
Best practices
Never hardcode keys in source code
Never hardcode keys in source code
Use environment variables or a secrets manager. If a key leaks in a git commit, revoke it immediately.
Use separate keys for each environment
Use separate keys for each environment
Create different keys for development, staging, and production. This way you can revoke one without affecting others.
Set expiration dates for temporary keys
Set expiration dates for temporary keys
If you’re sharing a key with a contractor or for a demo, set an expiration so it auto-disables.
Monitor usage in the dashboard
Monitor usage in the dashboard
Check the usage logs to spot unusual patterns. Each log entry shows which key made the request.