AuthFlame authenticates every request with a bearer API key. Pass your key in the Authorization header on each call.
API keys
Keys are issued from your AuthFlame dashboard and look like:
The af_live_ prefix identifies a live (production) key. API keys currently authorize email checks only, but treat them as secrets: a leaked key lets anyone burn through your check quota or run checks against your account until you rotate it.
Add an Authorization header of the form Bearer <api_key> to every request.
Best practices
API keys authorize email checks from your account. A leaked key can be used to exhaust your quota or run unwanted checks, so never embed keys in browser code, mobile apps, or public repositories.
- Store keys in environment variables or a secret manager, not in source control.
- Call AuthFlame only from your backend. Public clients should never see the key.
- Rotate keys if you suspect exposure. Old keys can be revoked from the dashboard.
- Use separate keys per environment (development, staging, production) so you can revoke one without affecting the others.
Authentication errors
Requests with a missing, malformed, or revoked key return 401 Unauthorized. See Errors for the response shape.