Authentication
Every /v1 request authenticates with an API key sent as a bearer token:
Authorization: Bearer sk_live_your_keyGetting a key
Mint keys in the dashboard. A key belongs to your organization; usage and rate limits are metered per org, not per key, so you can rotate keys freely without losing your quota.
Copy your key when you create it; it's shown once. If you lose it, revoke it in the dashboard and mint a new one.
Using it
curl https://api.disburse.dev/v1/verify/email \
-H "Authorization: Bearer sk_live_your_key" \
-H "Content-Type: application/json" \
-d '{"email": "ada@acme.com"}'The same key works on the REST API and the MCP server; one credential for both surfaces.
Missing or bad keys
A request with no key, an unknown key, a disabled key, or an exhausted quota is
rejected with 401 and a JSON error:
{ "error": { "code": "unauthorized", "message": "Invalid API key" } }See Errors for the full list of codes.
Keep keys secret
- Send keys only over HTTPS, server-to-server. Never ship one in client-side code or a public repo.
- Rotate immediately if a key leaks, revoke it in the dashboard and mint a new one. Revocation takes effect right away.