x-api-key header:
401. A key that may not use an API, or a
request for something your plan does not include, gets 403.
Keep your key safe
- Keep the key on your server or in an environment variable. Do not ship it in browser or mobile code.
- Use a separate key for each application, so you can revoke one without touching the others.
- If a key leaks, revoke it in the platform and create a new one.

