Skip to main content
Every API request needs an API key. Keys start with spd_.

​
Get a key

Your first key is created when you sign up. To add more, open API Keys in the dashboard, click Create API key, and give it a name that says where you’ll use it (“Production”, “Local”, “Cursor”). The full key is shown once, when you create it. Spidra stores only a hashed copy, so it can’t show it again. Copy it into an environment variable straight away:
If you lose a key, create a new one and delete the old one.

​
Send the key

Put it in the Authorization header as a Bearer token:
The x-api-key header works too:
The SDKs and the MCP server take the key once, when you create the client or configure the server.

​
When it fails

​
Manage your keys

The API Keys page lists each key with its name, the first and last characters, when it was created and when it was last used.
  • Turn a key off with its switch. Requests with it are refused until you turn it back on. Use this if you think a key leaked but aren’t ready to replace it.
  • Delete a key to remove it for good. Anything still using it stops working straight away.
  • Your only key can’t be deleted. Turning off your only active key is allowed, after a warning, but then every API request fails until you turn it back on.
Spidra emails you whenever a new key is added to your account.

​
Keep keys safe

  • Keep keys in environment variables or a secrets manager, never in source code or front-end code.
  • Use a separate key for each app or machine, so you can turn one off without breaking the others.
  • If a key leaks, create a new one, switch your app to it, then delete the old one.