Header format.
Include the raw key in the X-API-Key header.
Do not place API keys in URLs, query strings, browser-exposed scripts, or public repos.
Required header
X-API-Key: pvn_live_your_key_hereOne-time key display.
Raw API keys are shown only when created. After that, the dashboard shows the key name, prefix, status, tier, and creation date. If a key is lost, create a replacement and revoke the old key.
API keys are shown only once when created and cannot be recovered later.
If you lose a key, create a replacement and revoke the old one.
Key lifecycle.
| Action | Where | Notes |
|---|---|---|
| Create | Dashboard API keys page | Shown once. Store it in your server secret manager. |
| Use | X-API-Key header |
Send only from trusted server-side code. |
| Rename | Dashboard API keys page | Changes only the display name; the key value and integrations remain unchanged. |
| Rotate | Create a new key, update your app, revoke the old key | Preferred response when a key might be exposed. |
| Revoke | Dashboard API keys page | Revoked keys can no longer score requests. |
Authentication errors.
| Status | Detail | Meaning |
|---|---|---|
| 401 | missing api key |
No X-API-Key header was sent. |
| 401 | invalid api key |
The key does not match an active workspace key. |
| 403 | inactive api key |
The key exists but has been revoked or disabled. |