Authentication | Salary Data API

Your key, the two headers that carry it, and replacing it.

Every call but GET / needs your key. Send it in one of two headers; both work the same.

Authorization: Bearer sda_live_...
X-API-Key: sda_live_...

A key in the address (?key=) is refused with bad_request, so keys never end up in logs or browser history.

Your key

One key per account, made when you sign up. It is shown in full once, when it is made, and saved in that browser for these pages. We keep only a fingerprint of it, so we cannot show it again.

Replacing it

In your account, under Keys: Replace the key. A new key is made and shown once, and the old one stops at once, so anything still using it gets unauthorized until it has the new one.

Your plan follows your account

The plan is read from the account on every call, never from the key. An upgrade counts from the next call, with the same key.