Authentication

API keys

Create and manage keys from your dashboard. A key belongs to a team — all runs, sessions, and usage are billed to that team. The full secret is shown only once at creation; we store it hashed (SHA-256) and can never reveal it again, so save it immediately.

Making an authenticated request

Send the key in the Authorization header as a Bearer token:

curl https://api.quicktane.com/v1/run \
  -H "Authorization: Bearer sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"language": "python", "code": "print(1)"}'

The SDKs pick the key up from the constructor or the QUICKTANE_API_KEY environment variable:

from quicktane import QuickTane

qt = QuickTane("sk_live_your_key")   # explicit
qt = QuickTane()                     # reads QUICKTANE_API_KEY

Failure modes

See Errors for the full error model.

Best practices

• Keep keys server-side only — never expose them in browsers, mobile apps, or public repos.
• Use separate keys per environment (staging vs production) so you can revoke independently.
• Store keys in a secret manager or environment variables, not in source control.