Authorization header. No OAuth, no per-tenant prefixes, no separate
session — one key, one user, scoped to your subscription tier.
Header format
pql_live_d7b9… (48 chars total). On the
development build of the website you’ll get pql_test_… keys
instead — same shape, hits the same staging endpoint.
Mint a key
1
Open the keys page
2
Create
Click Create key, give it a label (
bot-prod, laptop-jupyter, etc.).
The full token displays once — copy it immediately.3
Revoke if compromised
Click the trash icon next to the key’s row. The token is invalidated
instantly on the API side; existing in-flight requests succeed, the
next call returns 401.
Test it
/health does NOT require auth — it’s the cheap way to verify the API
is reachable. Every /v1/* endpoint does.