Skip to main content

​
API key format

Keys look like bd_live_…. Treat them as secrets.

​
How to send the key

Send the key in the x-api-key header on every request: 
GET /v1/campaigns HTTP/1.1
Host: api.example.com
x-api-key: bd_live_your_key_here
Do not rely on the Authorization header for Botdog API keys; the API is documented and tested with x-api-key.

​
Rate limiting

Authenticated routes apply per API key rate limits (see Rate limiting). Invalid or missing keys are rejected before the rate limit runs.

​
Security practices

  • Rotate keys from the dashboard if they may be exposed.
  • Never embed keys in browser-side code or mobile apps shipped to customers.
  • Prefer environment variables and secret managers on the server.

​
API Reference playground

On the API Reference tab, open an operation page (for example List users under Users), then use Try it to call the API. Pick Production or your Local server in the server dropdown, enter your key in the auth section (x-api-key), then send the request. Requests from the hosted docs site are proxied by Mintlify so the browser is not blocked by CORS. Use a test key when experimenting. Do not paste production keys on shared computers.

​
Common errors

These are the usual auth-related cases. For the full HTTP status reference, error response shape, and retry guidance, see Errors.
StatusMeaningWhat to do
401Missing or invalid keyVerify the header name is x-api-key and the value matches an active key.
403Authenticated but not allowed for this actionCheck team membership and resource ownership.