The Abigail API uses two authentication methods:
API Key Authentication
All paid endpoints require an API key in the X-API-Key header.
Example: abi_sk_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
Using your key
Key lifecycle
- Create a key from Settings > API Keys
- The raw key is shown once — copy it immediately
- Only the SHA-256 hash is stored server-side
- Revoke a key anytime from Settings > API Keys
- Revoked keys are rejected immediately
Security best practices
Never commit API keys to source control. Use environment variables or a secrets manager.
- Store keys in environment variables:
ABIGAIL_API_KEY=abi_sk_...
- Rotate keys periodically
- Use separate keys for development and production
- Revoke keys immediately if compromised
Error responses
Missing key
Invalid key
Revoked key