Authentication, scopes & plans

API keys

Send your key in one of three ways, accepted the same on every REST endpoint and on the WebSocket: Authorization: Bearer xsf_…, the X-API-Key header, or ?api_key= in the URL (meant for browsers, which cannot set headers on a WebSocket handshake). If you send more than one, Authorization is used first, then X-API-Key, then api_key. A key that does not exist and a key that has been revoked are told apart: invalid_api_key means check for a typo or an old secret, key_revoked means talk to whoever issued it.

Scopes

A key carries scopes. A call outside them returns 403 with {"error":{"code":"scope_required"}} naming the scope you lack. GET /v1/account lists yours; GET /v1/meta/scopes lists all of them.

Administrative scopes exist for our own operators and are served on a separate, private interface. A customer key can never carry one.

Plans

A plan is a preset of scopes and caps; any key can be adjusted individually. The live matrix is at GET /v1/meta/plans. Prices are not published here.