Authenticate with a server-side API key.
EXDZ keys are revocable credentials. Send one in a request header, store it as a secret and rotate it without exposing it to users.
Send your key
Bearer authentication is canonical and works consistently across HTTP clients.
Authorization: Bearer exdz_live_••••••••••••••••The x-api-key header is supported for clients that cannot set a Bearer token.
x-api-key: exdz_live_••••••••••••••••Store it safely
- Load the key from a deployment secret or environment variable.
- Keep development and production keys separate.
- Do not commit .env files or include keys in client-side bundles.
- Redact authorization headers from application and proxy logs.
- Share only the visible key prefix when contacting support.
EXDZ stores a one-way hash rather than the complete secret. A lost key cannot be recovered; issue a replacement.
Rotate or revoke
Create or request a new key before disabling the old one.
Update your secret manager and verify a production request with the new prefix.
Disable the previous credential when all workloads have moved.
Browser applications
Live keys are designed for server-to-server use. Any key embedded in JavaScript delivered to a browser is public, even when minified.
Call EXDZ from your own backend and return only the data your interface requires. Contact EXDZ before building a public client-side integration that needs origin-restricted credentials.