Authentication

Every API request authenticates with an API key sent in the Authorization header, using the Bearer scheme. A key belongs to an account: it grants access to all of that account's files, links and logs.

Authorization: Bearer sd_live_3f9c1a…

curl https://docs.traductionexpert.com/api/v1/account \
  -H "Authorization: Bearer $SECURE_DOCS_API_KEY"

Create a key

In Dashboard > API keys, pick a name that describes its use (for example “production” or “staging”), then create the key. It always starts with sd_live_.

The full key is shown only once, when it is created. secure-docs keeps only a hash of it and cannot send it back to you. If you lose it, create a new one and revoke the old one. After that, the dashboard shows only its prefix and the date it was last used.

Store the key

• Keep it in an environment variable or a secrets manager, outside your Git repository.
• Use a separate key per environment and per application, so you can revoke just one.
• Don't log it: redact the Authorization header in your HTTP logs.

Revoke a key

In Dashboard > API keys, revoke the key. Revocation is immediate: the next request that uses it gets a 401 response. Files and view links already created remain valid, since they belong to the account, not to the key.

Keys per plan

Revoked keys don't count toward the limit.

Authentication errors

The API responds with 401 if the header is missing or malformed, or if the key is unknown or has been revoked. The message doesn't say which of these applies.

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{ "error": "invalid API key" }