Swytcho API Authentication: Keys, Headers & Security

Every request to the Swytcho API must be authenticated with an API key. You pass your key as a Bearer token in the Authorization header of each HTTP request. Requests that omit the header or supply an invalid key are rejected immediately with a 401 Unauthorized response.

Header Format

Include the following header in every API request, replacing YOUR_API_KEY with your actual key:

Authorization: Bearer YOUR_API_KEY

Example Request Headers

curl https://api.swytcho.com/v1/models \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

import os
from swytcho import Swytcho

client = Swytcho(api_key=os.environ["SWYTCHO_API_KEY"])

import Swytcho from "swytcho";

const client = new Swytcho({
  apiKey: process.env.SWYTCHO_API_KEY,
});

Obtaining an API Key

Generate and manage your API keys from the Swytcho Dashboard. Each key is shown only once at creation time — copy it immediately and store it securely. If you lose a key, revoke it and generate a new one.

Security Best Practices

Follow these practices to keep your API key safe:

Use environment variables. Store your key in an environment variable such as SWYTCHO_API_KEY and read it at runtime. Never hard-code it in source files.
Add key files to .gitignore. If you use a .env file locally, make sure it is listed in .gitignore so it is never committed to version control.
Rotate keys periodically. Generate a new key on a regular schedule and revoke the old one to limit the blast radius of any undetected exposure.
Use separate keys per environment. Maintain distinct keys for development, staging, and production so you can revoke a compromised key without affecting all environments.
Restrict key scope where possible. The dashboard lets you assign keys to specific projects — use the narrowest scope that satisfies your use case.

Never expose your API key in client-side code, public repositories, logs, or error messages. Anyone who obtains your key can make requests that are billed to your account. If you suspect a key has been compromised, revoke it immediately from the Swytcho Dashboard.

Authentication Errors

When a request fails authentication, the API returns a 401 Unauthorized status code with a JSON error body:

{
  "error": {
    "type": "authentication_error",
    "message": "Invalid API key provided. Ensure your Authorization header is set to 'Bearer YOUR_API_KEY'.",
    "code": "invalid_api_key"
  }
}

Common causes of 401 errors include:

Cause	Fix
Missing `Authorization` header	Add `Authorization: Bearer YOUR_API_KEY` to every request
Malformed header (e.g., no `Bearer` prefix)	Ensure the value is exactly `Bearer <key>` with a single space
Revoked or deleted key	Generate a new key from the dashboard
Key copied with leading/trailing whitespace	Trim whitespace before storing or passing the key

Overview

Endpoints

Swytcho API Authentication: Keys, Headers & Security

Header Format

Example Request Headers

Obtaining an API Key

Security Best Practices

Authentication Errors

​Header Format

​Example Request Headers

​Obtaining an API Key

​Security Best Practices

​Authentication Errors

Header Format

Example Request Headers

Obtaining an API Key

Security Best Practices

Authentication Errors