Authentication
The API is server-to-server. Every request sends a key.
The header
HTTP
Authorization: Bearer a54_test_…
Authorization: Bearer a54_live_…Create and copy keys in the dashboard.
Prefixes
| Prefix | Mode | Use |
|---|---|---|
| a54_test_ | Test | Building, demos and the console |
| a54_live_ | Live | Your product, after approval |
Prefixes are exact: lowercase, with underscores. A54_LIVE_… or a54-live-… answers 401 missing_key.
Looking after a key
- A key is shown once. We keep a hash, so nobody at Arena54 can read it back to you.
- Keep keys in your server’s secret store. Do not commit one, and do not ship one to a browser or a phone.
- Use one key per product or environment, named for it, so you can revoke one without stopping the others.
Rotate
Rotating gives you a new key. The old one keeps working for the grace period shown when you rotate, so you can deploy the new key first. After that the old key answers 401 invalid_key.
Revoke
A revoked key is refused on its next request. If a key leaks, revoke it and create another; a new key costs nothing.
When a key is refused
| Answer | Cause |
|---|---|
| 401 missing_key | No Authorization header, or not in the form Bearer a54_… |
| 401 invalid_key | Unknown, revoked, or past its grace period after a rotation |