Security

API key generation

When you create an API key from the dashboard:

1. A raw key is generated: wk_ followed by 64 random characters
2. Only a one-way hash of the key is stored
3. The raw key is returned to you exactly once

This means:

• If the database is compromised, raw keys cannot be recovered
• You see the raw key only at creation time
• Lost keys must be revoked and regenerated

Request authentication

API requests are authenticated by sending the API key in the Authorization header:

Authorization: Bearer wk_<64-characters>

On each request:

1. The server looks up all API keys for the project identified by the slug
2. Each stored key hash is compared against the provided key
3. If any hash matches, the request is authenticated

This approach allows multiple active keys per project while keeping stored keys secure.

API key management

• Keys are project-scoped - each key belongs to exactly one project
• Keys can be named to identify their use (e.g., "Production", "Staging")
• Keys can be revoked at any time from the dashboard
• Revoked keys are deleted immediately - integrations using them will stop working
• Only the key name and a masked value are visible in the dashboard after creation

Best practices

• Store API keys in environment variables, never in source code
• Use separate keys for development and production environments
• Rotate keys periodically from the API Keys dashboard page
• If a key is compromised, revoke it immediately and generate a new one
• For browser usage, prefix environment variables with NEXT_PUBLIC_ (Next.js) or your framework's equivalent for client-side access

Session authentication

The dashboard and management API use session-based authentication via HTTP-only cookies. These sessions are distinct from API key authentication and are not used by the public waitlist endpoints.