Authentication

Every request is authenticated with a bearer API key.

Create keys on the API Keys page and send them in the Authorization header.

Authorization: Bearer thw_live_xxxxxxxxxxxxxxxx

thw_live_… — live keys for production traffic.

thw_test_… — test keys for development.

Keys are stored hashed — the raw value is shown only once at creation. If you lose it, create a new key.

Revoke a key any time from the dashboard; revoked keys immediately return 401 INVALID_API_KEY.