Authentication
Bearer keys, kept server-side. Browsers can't call this API directly.
Bearer keys#
Every gate call carries Authorization: Bearer sk_live_.... Keys are issued from the console and stored hashed — nobody, including StormDoor, can recover a lost key's plaintext; issue a new one instead.
Keep it server-side#
This API is built to be called from a server, never from a browser. Don't embed a key in client-side JavaScript, a mobile app bundle, or anything else a visitor's browser executes — treat it exactly like a database credential.
Browsers can't call this API#
This isn't just a recommendation — it's enforced. The API sends no CORS headers, and any request carrying a browser Origin header is rejected outright with 403 origin_not_allowed, not failed open. If you need a browser-facing demo or playground, put a server endpoint of your own in front that calls this API server-to-server, the same way StormDoor's own playground does.
Rotating a key#
Issue a new key from the console before revoking the old one, so a deploy has a window to pick up the new value. A revoked key fails every call with 401 unauthorized immediately.