Authentication

Keys look like gdd_live_ followed by 48 hex characters. We store a hash of the key, never the key itself, so the full secret appears once, when it is created on your account page. A missing, malformed or revoked key answers 401 invalid_key.

• Keys belong to the plan, not to a person. Everyone on a Business plan draws from one monthly budget and one per-minute allowance.
• There is no charge for extra keys. Make one per integration so you can revoke one without touching the others.
• Revoking a key on the account page stops it on the next request.
• A key on a cancelled plan stops working when the plan ends.

The API accepts keys only in the Authorization header, on purpose. A key in a query string is written to every log between you and us, sits in browser history, and in a spreadsheet it is readable by anyone the sheet is shared with. Because the budget is per plan, one leaked key can spend a whole team's month.

Keep the key in an environment variable or a secrets store. For Google Sheets, use the Apps Script recipe, which keeps the key in script properties rather than in a cell.