Authentication

All Airaa API requests require authentication via a Bearer token.

Getting an API key

API keys are not self-serve. Contact the Airaa team to request access. Keys are issued per organization.

Making authenticated requests

Include your API key in the Authorization header of every request:

GET /v1/contributors HTTP/1.1
Host: api.airaa.xyz
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Error responses

Status	Code	Meaning
401	unauthorized	Missing or invalid API key
403	forbidden	Valid key but insufficient permissions for this resource
429	rate_limited	Request rate exceeded; check Retry-After header

Key management

API keys do not expire automatically but can be revoked by the Airaa team on request. Treat your key as a secret - do not expose it in client-side code or public repositories.

To rotate a key, contact [e-mail].