Authentication
Every /v1 and /mcp request needs an API key. Send it in any of these headers:
| Header | Example |
|---|---|
x-api-key | x-api-key: apz_xxx (recommended) |
Authorization | Authorization: Bearer apz_xxx |
api-key | api-key: apz_xxx |
Managing keys
Create, rename, disable and delete keys in Dashboard → API keys. The full key is shown only once; we store a SHA-256 hash.
IP allowlist
On Pro and above, restrict a key to specific client IPs. Requests from other IPs get 403.
Keep keys server-side
Never ship a key in a browser or mobile app. Call Apizie from your backend and forward the result.