API Authentication

All API requests require authentication via an API key passed in the Authorization header.

Getting Your API Key

Go to Settings > API Keys in your project.

Click Generate New Key. Give it a descriptive name (e.g., "Production Backend").

Copy the key — it's only shown once. Store it in your environment variables.

Include the API key in the Authorization header with the Bearer prefix:

curl -X GET https://your-convex-url.convex.site/api/entities \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

All API endpoints are served from your Convex deployment URL:

https://<your-deployment>.convex.site/api/

All responses use JSON with a consistent structure:

Authorizationstringrequired

API key with `Bearer` prefix. Example: `Bearer ds_key_abc123...`

Content-Typestringrequired

Must be `application/json` for all requests with a body.

X-Project-Idstringrequired

The project ID to scope the request to.

4 of 4

Warning

Never expose your API key in client-side code. Always make API calls from a server or backend service.