[ docs ]Guide
Authentication
Every paid call carries an API key. A key belongs to your account, spends its credit balance, and can be revoked in one click.
API keys
Create a key in the dashboard under API keys. Give it a name that says where it will live — staging, the CRM sync — and, if you want a hard stop, an expiry. The full key is shown once, at creation; after that only its first characters are visible, so you can match it to a config file but never read it back.
Keys start with zk_live_. Store them as secrets, never in client-side code: anyone holding a key can spend the balance it is attached to.
Sending the key
Either header works; use whichever your HTTP client makes easy.
X-API-Key: zk_live_…
# or
Authorization: Bearer zk_live_…A request without a valid key answers 401 with error.code = "unauthorized". Unknown, revoked and expired keys get the same answer on purpose — the response never says which.
What a key can do
A key can run every platform op and read the balance. It cannot manage keys, change billing or reach anything in the dashboard — those need a signed-in session.
The dashboard shows, per key, how many calls it has made and how many credits it has spent, so a leaked or runaway key is visible as a line item and not as a surprise on the balance.
Revoking is immediate and cannot be undone. In-flight calls finish; the next one is a 401. Anything already fetched stays in your account — revoking access is not a refund.
Checking the balance
GET https://api.zomler.com/api/v1/balance with your key returns the spendable credits. You rarely need it: every response carries cost.creditsRemaining, so a loop can watch its own budget without a second call.
curl https://api.zomler.com/api/v1/balance \
-H "X-API-Key: zk_live_…"