Authentication

Send your key as a bearer token

Every request to the API must carry an Authorization header. There is no other way to authenticate — no session, no query parameter:

Authorization: Bearer TOPICLOOPS_API_KEY

Requests without the header, or with a key that is not valid, are rejected with unauthorized. A valid key belonging to an account that is not entitled to the resource is rejected with forbidden instead.

Where to find your key

Your key is on the API page of your account, masked by default — reveal it to read it, or copy it straight to the clipboard without putting it on screen.

Keys are issued by hand at the moment. If you are on a plan that includes API access but no key has been issued yet, that page tells you how to ask for one.

Keep it secret

A key carries your account's full API access, and anyone holding it can spend your credits. Treat it like a password:

• Keep it server-side. Anything you ship to a browser or a mobile app is readable, so a key must never appear in front-end code.
• Load it from an environment variable or a secret manager rather than committing it to your repository.
• Keep it out of screenshots, logs, and support tickets — request logs that capture headers are a common way for a key to leak.

If a key is exposed, email info@topicloops.com and we will replace it.