serpix
Get API key

02 — authentication

Authentication

Every request carries an API key as a Bearer token. Keys are created in the console, shown once, and stored hashed. Treat them like passwords.

The Authorization header

Serpix keys start with sx_live_. Send yours on every request in the standard Authorization header:

authenticated request
export SERPIX_API_KEY="sx_live_..."

curl "https://api.serpix.io/v1/search?q=coffee+grinders" \
  -H "Authorization: Bearer $SERPIX_API_KEY"

Keys and organizations

Keys belong to an organization, not a person: credits, usage logs, and billing all roll up to the org that owns the key. You can create as many keys as you like (one per environment or service is typical) and revoke any of them instantly without affecting the others.

The full token is shown exactly once, at creation. Serpix stores only a hash. If a key is lost, revoke it and mint a new one.

When authentication fails

Authentication failures return 401 with a JSON body describing the reason:

401 — unauthorized
HTTP/2 401
content-type: application/json

{ "detail": "invalid api key" }
401 reasons
fieldtypedescription
missing api keydetailNo Authorization header on the request.
not an api keydetailThe Bearer token doesn't start with sx_live_. You may have sent a session token instead of an API key.
invalid api keydetailThe key doesn't exist or has been revoked.

Requests that fail authentication are never charged.