Authentication
Keep bearer keys on your server.
Create a key in the Secnd console at /dashboard. Copy the secret when it is first shown; later views show only its prefix. Keep it in your server’s secret store as SECND_API_KEY.
Send this header to both POST /v1/decide and GET /v1/models:
Authorization: Bearer <SECND_API_KEY>Never embed a key in browser JavaScript, mobile binaries, a public repository, or a docs playground shared with another person. Your browser should call your own backend, which supplies the key.
Rotate or revoke
Create a replacement, update your server’s secret, verify one request, then revoke the old key in the console. If a key is exposed, revoke it immediately. A revoked key receives 401; retries cannot fix it.
API keys authorize inference. Console sign-in is separate and does not replace a bearer key in API requests. Dashboard administration is account-scoped.