Skip to content

Authentication

Updated

Every request carries one ChatterAPI API key. You do not need a Reddit or X developer account.

The Authorization header

Send the key as a Bearer token on every request:

header
Authorization: Bearer ca_live_0123456789abcdef0123456789abcdef01234567

The MCP server uses the same header.

Key formats

KeyFormatWhat it does
Liveca_live_ + 40 hex charactersCalls the real data sources and spends credits.
Testca_test_ + 40 hex charactersReturns recorded samples, never spends. See Test keys.

Creating, naming and revoking keys

  1. Open API keys in the dashboard.
  2. Choose Create key, give it a name you will recognise later (for example the app or server that uses it), and pick Live or Test.
  3. Copy the key. It is shown only once.
  4. To revoke a key, choose Revoke next to it. Calls using that key start failing with key_revoked straight away.

Keys are stored hashed, so nobody can show you a key again. If you lose one, create a new key and revoke the old one.

Keeping keys safe

  • Keep keys in environment variables or a secrets manager. Don't put them in code or a public repo.
  • Do not call the API from browser code with a live key, because anyone can read it there. Call from your server instead.
  • To rotate a key, create the new one, deploy it, then revoke the old one.
  • Use one key per app or server. That way, revoking one does not break the others.

Authentication errors