Every request to the Spoofey API needs an API key, sent as a bearer token:
Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxA missing or invalid Authorization header gets a 401. There's no separate signup for API access. It uses the same account and balance as the dashboard.
Creating and managing keys
Generate keys from Settings → API. Each one has a name (so you can tell them apart, like "Production server", "Staging" or a teammate's laptop) and you can have up to 10 active at a time.
The full secret is shown exactly once, immediately after you create it. Spoofey only stores a hash of it, the same way your account password is stored, so it can't be shown to you again. If you lose a key, revoke it and generate a new one; there's no way to recover a lost secret.
Revoking a key from the settings page takes effect straight away. Anything still using it gets a 401 on its next request.
Keeping a key safe
- Never put a key in client-side / browser code. Anyone who opens your page's network tab or view-source can read it and place calls (and spend your balance) with it. Call the Spoofey API from your own backend, and have your frontend call your server instead.
- Don't commit a key to source control. Load it from an environment variable or a secrets manager, the same as you would a database password.
- Use a separate key per environment or integration (production, staging, a specific service) so you can revoke one without affecting the others, and so a key's "last used" timestamp actually tells you something.
- If a key ever leaks (in a log line, a screenshot, a shared terminal), revoke it right away and generate a new one. There's no partial-revoke; it's all or nothing.
Is my key tied to my session login?
No. Signing out of the dashboard, changing your password, or your session cookie expiring has no effect on your API keys. They're a separate credential and only stop working when you revoke them.