API keys

Your keys

Create as many as you like — one per script, machine or environment keeps a leak small and makes the usage breakdown readable. A new key works immediately.

Using a key

Put it in the Authorization header of every request:

curl -i https://api.webbites.io/v1/api/usage \
  -H "Authorization: Bearer wb_live_…"

A 200 with a JSON body means the key is good. A 401 means the header never arrived or the key is no longer valid — see Authentication.

Revoking a key

The bin icon revokes a key on the spot; there is no undo and no grace period. Anything still using it starts getting 401s with the next request, so rotate in this order:

1. Create the new key.
2. Deploy it wherever the old one lives.
3. Watch the usage breakdown until the old key stops counting.
4. Revoke the old key.