Authentication

Authenticate with the dedicated Bearer API key safely.

Every request must include the dedicated key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Query-string keys are not accepted. A dashboard session Cookie cannot replace this key, and this key cannot access existing /bi/* routes.

Key handling

• Keep the key in a secret manager or protected environment variable.
• Never commit it to source control, logs, screenshots, or support messages.
• Do not enable Remember on this device in the Playground on a shared computer. That option stores the key in this documentation origin’s localStorage until it is cleared.
• Ask your Mellow contact to rotate the key if it may have been exposed.