~/docs cat authentication.md
Authentication
Every request carries your key in the x-api-key header. Keys are created, rotated and revoked in the dashboard, and each one is shown once.
request header
x-api-key: <YOUR_API_KEY>
Keep it server-side. A key grants full access to your account, so it never belongs in client code, an app bundle or a public repository. The SDKs read SCAMAI_API_KEY from the environment.
Send the key in x-api-key only. An Authorization: Bearer header is read as a dashboard session and answers 401.
Media handling and retention are covered by the privacy policy and DPA. Send save="false" to keep nothing after the answer.