Authentication

Authentication

All requests are authenticated with a bearer token. Never expose a secret key in client-side code.

Sending the key

const res = await fetch("https://api.acme.dev/v1/messages", {
  headers: { Authorization: `Bearer ${process.env.ACME_KEY}` }
});

Scopes

• read - list and fetch resources
• write - create and update
• admin - manage keys

A request beyond your key's scope returns 403 Forbidden.