Authentication

Every API request authenticates with an API key.

Authorization header (recommended)

Send the key in the Authorization header, prefixed with Key :

Authorization: Key <your-key>

Query parameter (fallback)

If a header isn’t practical — for example, a link pasted directly into a browser — the same key can be passed as a query parameter instead:

GET /api/queries?api_key=<your-key>

[!WARNING] A key in a URL ends up in server logs, browser history, and referrer headers far more easily than a header does. Prefer the Authorization header for anything scripted; reach for the query parameter only when there’s no other way to attach it.

If both are present on the same request, the Authorization header takes priority. A request that carries a valid session cookie authenticates as that session regardless of whether ?api_key= is also present — the cookie always wins when both are there.

[!NOTE] A request authenticated by API key (and not also carrying a session cookie) is exempt from CSRF protection — that check only applies to cookie-authenticated requests, since a key holder isn’t riding a browser session that a third-party site could forge a request against.

Where to get a key

There’s no self-service API key page — you can’t generate or view your own key from your account settings. Every user’s key is managed from the admin side: Access Control → Users, where an admin can regenerate a user’s key. Regenerating shows the new key once, in the confirmation dialog; it isn’t displayed again afterward, so copy it before closing that dialog. A key inherits whatever access its owning user has — it doesn’t get its own separate permission set.