API keys

Keys let something that is not a browser call the API: curl, a script, the Chrome extension, an agent.

Manage them at rewr.it/account while signed in.

Rules

• The secret is shown once, at creation. It is not recoverable. Lose it and you make a new key.
• Up to 5 active keys per account.
• Keys are prefixed hn_.
• Quota, plan, and wallet follow the key's owner, not the key. Five keys do not get five allowances.
• A key is a bearer credential. Anything holding it can spend your quota.

Endpoints

These require a signed-in session — you cannot use a key to mint another key.

Method	Path	Does
GET	/api/keys	List your keys. Metadata only, never the secret
POST	/api/keys	Create one. Body: { "label": "laptop" }. Response includes the secret
DELETE	/api/keys/:id	Revoke, immediately

Unauthenticated calls get 401 with "Sign in to manage API keys".

Using one

curl -N https://rewr.it/api/humanize \
  -H "Authorization: Bearer hn_..." \
  -H "Content-Type: application/json" \
  -d '{"text":"...","register":"email"}'

A Bearer header that is not a valid key is 401. It does not quietly become an anonymous request — a typo in a key fails loudly rather than burning someone else's three-a-day.

If a key leaks

Revoke it at /account or with DELETE /api/keys/:id, then create a new one. Revocation takes effect on the next request. There is no rotation grace period, deliberately.