Authentication
Keys, projects, rate limits and safe retries. Every request carries a bearer token; everything else on this page exists to stop you being billed twice.
Bearer tokens
Every request needs an Authorization header:
Authorization: Bearer sv_live_…The secret is shown once when the key is created and never again. We store only a SHA-256 hash, so support cannot recover it for you either. Lost keys get revoked and replaced, not recovered.
Never put a key in a URL. Query strings end up in proxy logs, browser
history and Referer headers. It belongs in the header.
Projects
Keys belong to a project, and usage is recorded against that project. A new account starts with one called Default, which is all most people ever need. Separate projects are useful when you want per-client or per-environment usage broken out, since reporting follows the key.
Rate limits
Limits are per project. Every account gets 30 requests per minute; buying credits adds credits, not rate. Higher limits are set per account on request.
Every response carries the current state:
X-RateLimit-Limit: 30
X-RateLimit-Remaining: 28
X-RateLimit-Reset: 1756290000Exceeding the limit returns 429 with a Retry-After header. A 429 is never
billed.
Rate limits and credits are separate things. Running out of credits returns 402 until you buy a pack. Running out of rate returns 429.
Idempotency
Send an Idempotency-Key header on any request you might retry:
Idempotency-Key: 3f9a2c81-b4e0-7d15-9c2a-0e4482118893Behaviour is exact, so you can rely on it:
| Situation | Result |
|---|---|
| Same key, same request | The original response, replayed. No second charge. |
| Same key, different request | 409 Conflict |
| Key older than 24 hours | Treated as new |
The 409 is deliberate. Reusing one key for two different requests is a client bug, and quietly returning the first response would hide it from you.
Keeping keys safe
- Server-side only. A key in browser or mobile client code is a public key.
- One key per environment, so revoking staging does not take production down.
- Revoke immediately if a key is exposed; revocation takes effect at once.
- Rotate by creating the new key, deploying, then revoking the old one.
Last updated 27 August 2026