Create an API key

A Strent API key lets your server ask Strent about the customers of one project. It works like a password for your server: never give it to your users or put it in browser code.

Create and store the key

1. Open Configuration → API keys.
2. Create a key with a name that identifies its consumer, such as api-production.
3. Copy the secret immediately. Strent reveals the full value only once.
4. Store it where your server keeps secrets, such as its environment variables.

STRENT_API_KEY=strent_test_your_opaque_secret

Each key starts with its project’s mode, so a key in the wrong place is easy to spot:

• strent_test_<opaque-secret> for Test projects.
• strent_live_<opaque-secret> for Live projects.

Never expose project keys

Do not place a Strent API key in client-side JavaScript, a mobile application, a public environment variable, logs, screenshots, or support messages. Calls to Strent belong in your trusted server environment.

Send the key

The Node.js SDK adds the header for you. Direct HTTP clients must send:

Authorization: Bearer strent_test_your_opaque_secret

A missing or malformed header returns 401 INVALID_AUTH_HEADER. A well-formed but invalid or unknown key returns 401 API_KEY_INVALID; a revoked key returns 403 API_KEY_REVOKED.

Rotate a key

Create a replacement, deploy it to the consumer, verify traffic, and then revoke the old key. Because keys belong to one project, rotation does not affect other application environments.

A project keeps at most 100 keys, revoked ones included, and names of up to 120 characters. When it is full, creating a key deletes the key revoked longest ago, which from then on returns 401 API_KEY_INVALID instead of 403 API_KEY_REVOKED. Creating a key fails only when all 100 are active; revoke one first.

Verify your setup →