Authentication and API Keys

API key basics

ThailandAPI uses subscription-scoped API keys.

How keys work

• Keys belong to a subscription, not to a single team member.
• A single subscription can have multiple keys for different environments or services.
• Requests are billed and rate-limited against the subscription attached to the key.

Sending a key

Use the X-API-Key header in every request.

GET /your-endpoint HTTP/1.1
Host: api-slug.your-domain.example
X-API-Key: tap_live_xxxxxxxxx

Security guidance

• Never expose production keys in frontend bundles.
• Rotate keys when a teammate leaves or a credential is shared too widely.
• Use different keys for local development, staging, and production.

Troubleshooting

• 401 usually means the key is invalid, revoked, or missing.
• 429 usually means the subscription hit a rate or quota limit.
• Billing and usage screens help you verify the active plan and remaining credits.