Keys

Make a key

On your account page, name the key and press Make a key. The whole key is shown once. Copy it then; we can't show it again.

You can have up to 10 keys. Give each program its own, so you can revoke one without stopping the others. Every key shares your plan's one allowance.

Send it

Send it in the Authorization header on every request:

Never put it in a URL. A request with a key in its query string gets a 400 and does nothing.

Authorization: Bearer bullpen_…

Keep it secret

A key is like a password. Keep it in an environment variable or a secrets manager, never in code you commit or share. You answer for everything done with your keys.

Keys don't expire. To rotate one, make a new key, move your program to it, then revoke the old one.

Revoke a key

Press Revoke beside it on your account page, then confirm. Programs using it get a 401 at once. Revoking can't be undone.

If a key leaks

Revoke it and make a new one.

What a key looks like

bullpen_ and 38 letters and digits. Treat it as an opaque string: its length may change.

For AI agents

Read the key from BULLPEN_KEY. Never ask a person to paste it into a chat. If a request gets a 401, send them to bullpen.news/account to make a key.