Authorization header on each call.
API keys
Keys are issued from your AuthFlame dashboard and look like:af_live_ prefix identifies a live (production) key. API keys currently authorize email checks only, but treat them as secrets: a leaked key lets anyone burn through your check quota or run checks against your account until you rotate it.
Sending the header
Add anAuthorization header of the form Bearer <api_key> to every request.
Best practices
- Store keys in environment variables or a secret manager, not in source control.
- Call AuthFlame only from your backend. Public clients should never see the key.
- Rotate keys if you suspect exposure. Old keys can be revoked from the dashboard.
- Use separate keys per environment (development, staging, production) so you can revoke one without affecting the others.
Authentication errors
Requests with a missing, malformed, or revoked key return401 Unauthorized. See Errors for the response shape..png?fit=max&auto=format&n=I1VHCABaGN8XUrA3&q=85&s=a6ef4d31dcedaa6714272989ceab62a2)
.png?fit=max&auto=format&n=I1VHCABaGN8XUrA3&q=85&s=d9708474bd0c0cd8c6223006c4baeca5)