Skip to main content

API Key

After partner approval, Gauntlet provisions an API key for your organization.
Store this in an environment variable — never in client-side code or version control.

Make Authenticated Requests

Pass the API key as a Bearer token in the Authorization header:
Or use the SDK, which handles auth internally:

Rate Limits

API access is rate-limited per partner: 60 requests/minute and 10,000 requests/day. On 429, back off until X-RateLimit-Reset. Cache vault metrics and meta responses to reduce request volume.

Error Codes

Security

Never expose your API key in client-side code, public repos, or browser-accessible bundles. Use server-side environments only.
  • Store keys in environment variables, add .env to .gitignore
  • Use separate keys for development, staging, and production
  • Rotate production keys every 90 days