API Keys and Authentication

Create, store, rotate, and use API keys safely.

Create a key

Open API Keys from the Studio sidebar. Create or rotate the account key and copy it into a secure secret store.

Use the key

Send the key in the documented API-key header for generation and artifact routes. Do not place it in query strings, browser code, screenshots, logs, or source control.

Rotate exposed credentials

If a key appears in a public repository or untrusted log, rotate it immediately and update every integration. Old credentials should be treated as compromised.

Server-side use

Call the API from trusted backend, CLI, CI, or local development environments. A public client application should use its own backend rather than exposing the Gamelabs key.