Overview
API keys are used to authenticate your requests to the Chidori API. Each key is tied to your account and can be configured with specific permissions and environment modes.API key structure
Chidori API keys follow this format:| Component | Description |
|---|---|
sk_ | Prefix indicating a secret key |
{mode} | Either sandbox or live |
{id} | Unique identifier (UUID) |
{secret} | 32-character secret hash |
Creating API keys
1
Log in to your dashboard
Navigate to chidori.africa/dashboard and sign in.
2
Go to API Keys section
Find the API Keys section in your dashboard navigation.
3
Create a new key
Click Create API Key and fill in the details:
- Name: A descriptive name (e.g., “Production Server”, “Development”)
- Mode: Choose
sandboxfor testing orlivefor production - Permissions: Select the permissions this key should have
4
Copy your key
After creation, you will see the complete API key. Copy it and store it in a secure location like a password manager or environment variables.
Using API keys
Include your API key in theX-API-Key header for all API requests:
Revoking API keys
If an API key is compromised or no longer needed, revoke it immediately:1
Access your dashboard
Go to chidori.africa/dashboard.
2
Find the key
Locate the API key you want to revoke in the API Keys section.
3
Revoke the key
Click the revoke button. The key will be immediately invalidated.
Security best practices
Never expose keys in client-side code
Never expose keys in client-side code
API keys should only be used in server-side code. Never include them in:
- JavaScript running in browsers
- Mobile app source code
- Public repositories
- Client-side configuration files
Use environment variables
Use environment variables
Store API keys in environment variables, not in your codebase:
Use separate keys for each environment
Use separate keys for each environment
Create different API keys for:
- Local development (sandbox)
- Staging/testing (sandbox)
- Production (live)
Rotate keys periodically
Rotate keys periodically
Regularly rotate your API keys, especially for production environments. Create a new key, update your applications, then revoke the old key.
Use minimum required permissions
Use minimum required permissions
Only grant the permissions each key actually needs. See Permissions for details.
Error responses
When authentication fails, you will receive one of these errors:| Status Code | Message | Cause |
|---|---|---|
401 | Unauthorized | Missing or invalid API key |
403 | Forbidden | Key lacks required permission |