Rules
- 1Keys are displayed once at creation and stored hashed — we cannot recover one.
- 2Send keys in the x-api-key header, never in a query string.
- 3Revoke immediately if a key appears in a repository or log.
- 4Rotate by creating the new key, switching traffic, then revoking the old one.
Errors
- 1401 — missing or invalid key.
- 2404 — the resource does not exist or is not yours.
- 3422 — the request body failed validation; the response names the field.