All API requests require a Bearer token in the Authorization header.
Creating an API key
- Go to Settings → API Keys
- Click New Key, give it a name, and choose a permission level
- Copy the key — it’s only shown once
Store your API key in an environment variable or secrets manager — never commit it to source control. Keys are prefixed with pf_ so they’re easy to detect in accidental leaks.
Permission levels
Use read_only keys for client-side or agent integrations where you don’t need to upload. See API Keys for the full object reference and plan limits.
Revoking a key
Revoke a key immediately from the API Keys dashboard if it’s compromised — requests using it will be rejected within seconds. 
