Guides / Get started / Authentication

Authentication

Every request needs an API key in the x-api-key header. Each key has its own credit balance; your plan sets its rate limit.

Send the key

Pass the key in the x-api-key header on every request. Requests without a valid key return 401 unauthorized and cost nothing.

cURL

curl "https://api.tikultra.com/v1/user?username=acme" \
  -H "x-api-key: $TIKULTRA_KEY"

Create and revoke keys

Create one key per app or environment in API keys, so you can revoke one without touching the others. The full key is shown once. Each key keeps its own credit balance; choose which key a top-up goes to in Billing.

Keep keys server-side. Never put a key in browser or mobile app code. Store it in your secret manager.