Authentication

One header. No OAuth dance.

Every call to api.souslab.site/v1/* requires a single header. Keys are long-lived, prefixed with sk_live_, and stored hashed.

The Bearer header

Generate a key from the dashboard. The plaintext is shown exactly once at creation — we only ever store its SHA-256 hash. Rotate freely; revocation takes effect on the next request.

Authorization: Bearer sk_live_a3F8B2c…
200 OK · 38 ms

Key format

  • Prefix: sk_live_ — visible in the dashboard.
  • Body: 32 base64url characters (256 bits of entropy).
  • Display prefix: first 8 characters after the underscore — used to identify a key in the UI without exposing it.

Rate-limit headers

Every response carries the three rate-limit headers your code needs to behave:

HeaderMeaning
X-RateLimit-LimitMonthly request cap for your plan
X-RateLimit-RemainingRequests left in the current period
X-RateLimit-ResetUnix timestamp when the window rolls over
X-Request-IdCorrelation ID, useful when you email support

Rotating a key

  1. Create a new key in the dashboard.
  2. Deploy the new key to production.
  3. Once you've confirmed the new key is in use (check its Last used timestamp), revoke the old key.
  4. Revocation is effective on the next request.