API authentication

Every request to the Public Surface API is authenticated with a project API key, sent as a bearer token.

API keys

Generate a key from Settings → API Keys. Keys are scoped to a single project and can be revoked at any time.

curl https://api.example.com/v1/events \
  -H "Authorization: Bearer $PUBLICSURFACE_API_KEY" \
  -d '{"message":"hello"}'

curl https://api.example.com/v1/events \
  -H "Authorization: Bearer $PUBLICSURFACE_API_KEY" \
  -d '{"message":"hello"}'

curl https://api.example.com/v1/events \
  -H "Authorization: Bearer $PUBLICSURFACE_API_KEY" \
  -d '{"message":"hello"}'

Rate limits

The API allows 600 requests per minute per key by default. Responses include rate limit headers so you can back off before hitting the limit.

If a key is ever exposed publicly, revoke and rotate it immediately from Settings → API Keys.