Authentication

One bearer token per request. Keys are created in the dashboard and shown exactly once.

Sending a key

curl -X POST https://conureapi.com/v1/bot-check \
  -H "Authorization: Bearer ck_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"52.1.2.3"}'

How keys are stored

We store a SHA-256 hash of your key, never the key itself. The plaintext exists in exactly one response — the one that created it — and nowhere else. That means we cannot show you a key again, and we cannot email it to you. Lost a key? Revoke it and create another.

Rotating a key

Create the new key in API keys.
Deploy it alongside the old one.
Once traffic has moved, revoke the old key.

Both keys bill the same balance, so there is no cost to overlapping them.

Revocation is not instant everywhere

A successful key lookup is cached at the edge location that served it, for up to 60 seconds. A revoked key can therefore keep authenticating for that long at a location that has already seen it. The revoke response tells you the exact window in propagation_seconds rather than leaving you to discover it during an incident.

What each 401 means

Message	Cause
`Missing Authorization header`	No header was sent.
`Invalid Authorization format`	The scheme was not `Bearer`, or the token was empty.
`Invalid API key`	The key is malformed, revoked, or never existed.

A storage outage returns 503, never 401

If we cannot reach the key store we say so, rather than telling you your credentials are wrong. A 401 always means the key is genuinely not valid.

Keys and your account are separate

Your API keys keep working whether or not you ever log in, change your password or enable Google sign-in. Nothing in the account system can invalidate a key except revoking it or deleting the account.