estudjo authenticates every request using API keys. You pass your key in the X-Api-Key HTTP header — there are no OAuth flows or session tokens to manage. Each key is scoped to your account, so all usage and credit spend are attributed to the key’s owner.
Pass your key
Include your API key in the X-Api-Key header of every request:
Get your first key
You can obtain an API key in two ways:
- Dashboard — Sign in at estudjo.com and generate a key from your account settings. This is the easiest path when you’re getting started.
- API — If you already have a key, call
POST /api-keys to create additional keys programmatically (for example, to issue per-integration keys or rotate credentials in CI).
Create a key programmatically
Use an existing key to mint a new one:
Your full API key is shown only once in the POST /api-keys response. Copy it immediately and store it securely — it cannot be retrieved again.
List your keys
Retrieve all API keys associated with your account. The key field is masked in list responses for security:
Rotate a compromised key
If a key is leaked or compromised, revoke it immediately with DELETE /api-keys/{id} and create a replacement:
Only the revoked key is invalidated — all other keys on your account continue to work.
Security best practices
- Store your API key in an environment variable (e.g.
ESTUDJO_API_KEY) rather than hard-coding it in your source files.
- Never commit API keys to version control. Add
.env files to .gitignore.
- Issue separate keys for separate integrations so you can revoke one without disrupting others.
- Rotate any key immediately if you suspect it has been exposed.
Authentication errors
