Authentication

Create an API key on the Developers page. The full secret is shown once and is stored only as a hash. A key looks like ck_live_ followed by a random token. You can keep 20 live keys. Revoking a key rejects later requests immediately.

Send it on storage requests and when you create a signed upload link:

Authorization: Bearer ck_live_your_secret

API keys do not create or revoke other keys. Do that from the dashboard while you are signed in.

A signed upload link is not an API key. It is a write grant for one object, one size, and one expiry. Reading with that link returns 403.

Gateway links are a third credential. They are created from the Gateway page and let someone read a stored object. They cannot upload.