Authentication

Sending the key#

Send the key as a bearer token in the Authorization header of every request.

Authorization: Bearer ag_test_4fT2…

A missing, wrong or revoked key gets 401 invalid_api_key. So does a staging key sent to production, or a production key sent to staging.

Keeping it safe#

• Call the API from your servers only. Never put the key in a mobile app, a browser or a public repository.
• Store it in a secrets manager or an environment variable, not in your code.
• We show a key once, when we issue it. We cannot show it again, only replace it.
• If a key may have leaked, tell us. We revoke it at once and issue a new one.

Rotating a key#

You can have two working keys at a time, so you can swap keys without downtime.

1. 1

   Ask us for a second key

   Both keys work while you roll out the new one.
2. 2

   Deploy the new key

   Switch every server over and check that calls succeed.
3. 3

   Ask us to revoke the old key

   It stops working the moment we revoke it.

Rate limits#

Your keys share 60 requests in any 60 seconds, with at most 2 in flight at the same time, and your account can send 10,000 workouts a day. Lookups count too. Send your calls one or two at a time rather than in parallel bursts.

Over the limit, you get 429 rate_limited with a Retry-After header: the seconds to wait. Then send the same request again. A short 429 can also come when the API is busy with other partners. If you need higher limits, talk to us.

Request IDs#

Every response has an X-Request-Id header. Log it with your own records. When you contact us about a call, send the request ID and we can find it straight away.