Authentication

Authorization: Bearer pk_live_…

• Keys belong to your organization, not to a person. Owners and admins create and revoke them on the Keys page.
• Each key is shown once, when it’s created. Pillar stores only a hash, so a lost key can’t be recovered: create a new one.
• Live keys start with pk_live_. Keys from the staging environment start with pk_test_ and don’t work in production.
• Keys only work while your organization has an API plan. Without one, requests return 402 no_api_plan.

Keep keys on your server

The API sends no CORS headers, so browsers can’t call it directly. Call it from your backend and never ship a key in front-end or mobile code. Requests with malformed or unknown keys are throttled per IP.

Rotate a key

• Create a new key and deploy it.
• Check Usage until the old key has no traffic.
• Revoke the old key. Requests with it fail with 401 key_revoked within seconds.