Skip to main content
AuthFlame authenticates every request with a bearer API key. Pass your key in the Authorization header on each call.

API keys

Keys are issued from your AuthFlame dashboard and look like:
The af_live_ prefix identifies a live (production) key. API keys currently authorize email checks only, but treat them as secrets: a leaked key lets anyone burn through your check quota or run checks against your account until you rotate it.

Sending the header

Add an Authorization header of the form Bearer <api_key> to every request.

Best practices

API keys authorize email checks from your account. A leaked key can be used to exhaust your quota or run unwanted checks, so never embed keys in browser code, mobile apps, or public repositories.
  • Store keys in environment variables or a secret manager, not in source control.
  • Call AuthFlame only from your backend. Public clients should never see the key.
  • Rotate keys if you suspect exposure. Old keys can be revoked from the dashboard.
  • Use separate keys per environment (development, staging, production) so you can revoke one without affecting the others.

Authentication errors

Requests with a missing, malformed, or revoked key return 401 Unauthorized. See Errors for the response shape.