Authentication · TubeExtract

API keys

Create keys in the dashboard under API keys. A key is shown in full once, at creation. After that only its first characters are visible, so store it wherever you keep secrets before closing the dialog.

NOTE

That is not a policy we could relax: only a hash of the key is stored, so there is nothing left to show you. A lost key is replaced, never recovered.

Test keys are prefixed tbx_test_ and live keys tbx_live_. Both bill the same way; the prefix is there so you can tell at a glance which environment a leaked key belongs to.

Sending the key

curl https://api.tubeextract.dev/v1 \
  -H "X-API-Key: tbx_live_..." \
  -H "Content-Type: application/json" \
  -d '{"videos": ["..."], "schema": {...}}'
 
# Authorization: Bearer works too
curl https://api.tubeextract.dev/v1 \
  -H "Authorization: Bearer tbx_live_..."

A missing or unknown key returns 401. Never put a key in browser code; every call should go through your own backend.

What a key can see

Keys are scoped to the workspace that created them. Reading a job that belongs to another workspace returns 404, not 403, so a wrong key cannot be used to discover which job IDs exist.

Rotating a key

Create the replacement first, deploy it, then revoke the old one. Revoking takes effect immediately and cannot be undone. Jobs already queued under a revoked key still finish; you can still read their results with any live key in the same workspace.