Create keys from the authenticated API settings page.
A key is displayed only when created. Store it in a password manager or secret store.
TruthGate stores a hash rather than a recoverable copy. Losing the original value requires creating a new key.
Preferred:
X-API-Key: YOUR_KEYLegacy or convenience forms may be accepted on supported routes:
?api_key=YOUR_KEY
?key=YOUR_KEY
Headers are preferred because URLs are more likely to appear in browser history, proxy logs, analytics, screenshots, and copied links.
Browser-based management uses the login session. Do not build automation that scrapes login forms when API keys are available.
Invalid, missing, and suspended credentials should not reveal which condition occurred. A banned client may be rejected before credential processing.
- Create a replacement key.
- Update the client.
- Verify successful requests.
- Revoke the old key.
Never commit API keys to source control or .env.example.