Authentication

Every /v1 request requires a Developer API key in the Authorization header:

Authorization: Bearer tg_api_YOUR_SECRET

Key lifecycle

• Create keys in the dashboard. The plaintext secret is returned once in the create response.
• ToolGrid stores only a hash. Previously issued secrets cannot be retrieved.
• Revoke a key when it is compromised or retired. Requests with a revoked key fail auth.
• Rotation: create a new key → update your servers → verify → revoke the old key.

Secure storage

• Prefer server-side integrations (backend, worker, Edge Function with secrets).
• Never commit keys to git or ship them in client bundles.
• Do not put secrets in URLs, analytics events, or client-visible error logs.

Invalid key

Missing or invalid Bearer tokens return an authentication error (typically HTTP 401) with a stable error code in the JSON envelope. See Errors.