Every request needs a subtitle API key. Send it in one of two headers:
Authorization: Bearer st_...
X-API-Key: st_...
Keys are prefixed st_… and are scoped to an account.
| Property | Value |
|---|---|
| Key format | st_… |
| Auth headers | Authorization: Bearer <key> or X-API-Key: <key> |
| Free credits on signup | 100 |
| Key storage | Hash only — raw key shown once |
Key lifecycle
- Keys are created from the API Keys tab of your dashboard (a logged-in account) — there is no anonymous self-serve endpoint
GET /api/keys/balance— current credits and usage for the authenticated key- Losing a key means creating another one — the raw value is never stored
Keep it secret
Treat your API key like a password. Store it in environment variables or a secrets manager on the server — never in client-side code, public repos, or commit history.
Accounts & keys
Credits live on your account and are shared across all of that account's keys — keys themselves hold no balance, they're pure access tokens. Only logged-in accounts can hold credits or create keys. A legacy key created before the account model can be claimed from the dashboard to attach it to your account.