disburse / docs

Authentication

Every /v1 request authenticates with an API key sent as a bearer token:

text
Authorization: Bearer sk_live_your_key

Getting a key

Mint keys in the dashboard. A key belongs to your organization; usage and rate limits are metered per org, not per key, so you can rotate keys freely without losing your quota.

Copy your key when you create it; it's shown once. If you lose it, revoke it in the dashboard and mint a new one.

Using it

bash
curl https://api.disburse.dev/v1/verify/email \
  -H "Authorization: Bearer sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"email": "ada@acme.com"}'

The same key works on the REST API and the MCP server; one credential for both surfaces.

Missing or bad keys

A request with no key, an unknown key, a disabled key, or an exhausted quota is rejected with 401 and a JSON error:

json
{ "error": { "code": "unauthorized", "message": "Invalid API key" } }

See Errors for the full list of codes.

Keep keys secret

  • Send keys only over HTTPS, server-to-server. Never ship one in client-side code or a public repo.
  • Rotate immediately if a key leaks, revoke it in the dashboard and mint a new one. Revocation takes effect right away.