Guides

Authentication

Every request carries your API key as a bearer token. There are no sessions, cookies or signatures to manage.

Sending the key

Put the key in the Authorization header of every request to https://corollary-labs.com/api/v1. Requests are HTTPS only.

text

Authorization: Bearer cor_sk_…

Two errors, both 401. Neither ever falls back to another identity: a request with a bad key is refused, not served as somebody else.

missing_api_key: No Authorization header, or one that is not a bearer token. The response also carries WWW-Authenticate: Bearer.
invalid_api_key: The key is malformed, unknown or revoked. Check it was copied whole, and that it has not been revoked on the keys page.

Read it from an environment variable or a secrets manager. Never write it into source.
Use it from servers, notebooks and pipelines — never from a browser or a mobile app, where anyone can read it out of the network tab.
One key per deployment, named after it, so a leak is contained by revoking one key.
Revoke a key the moment it may have been exposed. Revocation is immediate; anything using it gets invalid_api_key on its next call.