API key security
2026-10-23T17:21:49+08:00Prepare an API key
Open Settings from the avatar menu in the console, then API Key in the personal center. Each account has one active key. Regenerating invalidates the old key immediately; the full key is shown only once. Send X-API-Key on every request and Content-Type: application/json on POST. No website JWT, Cookie, Device-ID, hash or platform is needed. A Bearer token cannot replace this header.
API key security
Store keys only on the server in environment variables or a secret manager, never in frontends, public repositories or client bundles. Do not put keys in URLs, bodies, logs or tickets. Examples use API_KEY. Generate and store keys in a trusted environment. Rotate or disable a leaked key and update every caller; rotation invalidates the old key and disabling rejects requests.
Errors and retries
For 400 fix parameters; for 401/403 check key or account; for 409 resolve resource conflicts; for 429 back off. Read requests may be retried within quota. Writes have no published idempotency key: after a timeout or 500, check whether work was accepted before retrying. Missing apps, version mismatches or provider submission errors may also return 500 / PUBLIC_API_INTERNAL_ERROR; this is not proof that nothing ran.
Validation and support
For support, provide request_id, endpoint, HTTP status, reason, time and redacted parameters, never the key. Validate integration with read-only lists first; use explicitly authorized test devices for writes and verify results before increasing batch size.
Related articles
Cookie Notice