Core concepts
Authentication
Create an spf_ key and send it on every request.
Every request to the API is authenticated with a Spoof API key. Keys are created in the dashboard and start with the spf_ prefix.
Create a key
Sign in at app.spoofzone.com, open the Keys page, and create a key. The secret is shown only once at creation, so copy it immediately and store it somewhere safe. It cannot be retrieved later.
You can hold up to three active keys at a time. Revoking a key takes effect immediately and preserves its usage history.
Keep your key secret
An API key can spend from your wallet. Never commit it to source control or ship it in client-side code. Use an environment variable, and rotate a key right away if it leaks.
Send the key
Include the key on every request using either header:
Both are equivalent, so use whichever your client prefers. The Anthropic and OpenAI SDKs both send the key for you when you set it at construction time (see SDKs).
Errors
A missing or invalid key returns 401 unauthorized. An inactive account returns 403 forbidden. See Errors for the full list of codes.