Authentication

Authentication

Learn how to authenticate your requests to the AIO Radar API.

Overview

The AIO Radar API uses Bearer token authentication. All API requests must include a valid API key in the Authorization header.

API Key Format

API keys follow this format:

text
aio_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

All keys start with aio_sk_ followed by 64 hexadecimal characters.

Authentication Header

Include your API key in every request:

Bash
Authorization: Bearer aio_sk_your_api_key_here

Example Request

Bash
curl -X GET "https://aioradar.vercel.app/api/sites" \
  -H "Authorization: Bearer aio_sk_abc123..."

Security Best Practices

Keep Keys Secret

Never expose your API key in:

  • Client-side JavaScript code
  • Public GitHub repositories
  • Log files
  • URLs or query parameters

Use Environment Variables

Store your API key in environment variables:

Bash
# .env file
AIO_RADAR_API_KEY=aio_sk_your_key_here

Rotate Keys Regularly

You can regenerate your API key from the dashboard at any time. When you do:

  • The old key is immediately invalidated
  • Update all applications using the old key

Error Responses

401 Unauthorized

Returned when:

  • No API key is provided
  • The API key is invalid or malformed
  • The API key has been revoked
JSON
{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  }
}

403 Forbidden

Returned when:

  • The API key is valid but doesn't have access to the requested resource
  • The site ID doesn't match the API key's authorized site
JSON
{
  "error": {
    "code": "FORBIDDEN",
    "message": "Access denied to this resource"
  }
}