Interactive Playground

Keep your API key secret

Your API key is like a password for your account. Anyone who has it can create access tokens and use the API on your behalf.

In a real application, your API key should only ever live on your server (backend). Your server uses the key to call the /v3/auth/tokens/get endpoint and then passes the short-lived access token to the browser. This way, the API key is never exposed to end users.

Never put your API key in frontend code — not in JavaScript files, HTML attributes, or environment variables that get bundled into browser builds. If it ends up in code that runs in the browser, anyone can view it.

Using it here is okay. This playground sends the key directly from your browser to the API over an encrypted HTTPS connection. It is not stored on any server, and it never leaves your machine except to reach the API. This is a developer tool for testing — just don't use this pattern in production.