Authenticate an API request

Send the API key header

The public programmatic API is served from https://api.threetone.in. Send the API key in the x-api-key request header:

curl --request GET \
  --url 'https://api.threetone.in/v1/convai/agents' \
  --header "x-api-key: $THREETONE_API_KEY"

Use the key as a header value. Do not put it in a URL, query string, or request body. A programmatic request should send x-api-key; sending it together with an Authorization header is rejected as ambiguous.

Keep the key on the server

Load the key from a server-side secret manager or environment variable. Do not embed it in frontend JavaScript, mobile application bundles, logs, or error messages. Use a separate, narrowly scoped key for each deployed integration so one leaked credential does not expose unrelated operations.

Record the request ID

Threetone returns an X-Request-Id response header. Keep that value with the request timestamp, method, path, and status when troubleshooting. You may also send your own valid X-Request-Id; the API echoes it in the response.