API Keys

Creating, storing, and revoking keys, and how scopes work.

Every account can create API keys

API access is self-serve and isn't tied to a subscription tier — any Stynar account can create keys from Settings → API keys, with no approval step. Every account starts on the same default limits: 50,000 requests a month, 60 requests a minute per key, a 10-requests-a-second burst, and up to 3 active keys. Contact support if you need more.

Open Settings → API keys

In the Stynar app, go to Settings → API keys. Every account has it — there's nothing to request.

Create a key

Click Create API Key. Choose a name and scopes (read and/or write).

Save it immediately

Your key is shown once, in full. Copy it somewhere secure — Stynar cannot show it to you again.

Use it as a Bearer token

Send it on every request as Authorization: Bearer esk_.... See Authentication.

Format

Authorization header

Authorization: Bearer esk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Scopes

Field	Type	Required	Description
read	scope	Optional	View-only endpoints — every GET on this API.
write	scope	Optional	State-changing endpoints — POST, PUT, PATCH, DELETE.

Scopes are chosen at creation time and can't be changed afterward — create a new key with different scopes instead. A key can hold both scopes at once.

Revoking a key

Revoke a key from Settings → API keys at any time. Revocation takes effect immediately — every request checks the key live, never against a cache.

Never expose secret keys in browser or client-side code

A key sent from client-side JavaScript, a mobile app bundle, or any code a user can inspect is effectively public. Call the Stynar API from your backend, and keep the key in a server-side secret store — never in a repo, a frontend bundle, or a URL query string.