Authentication - Sunor API

All API requests require authentication via an API key passed in the x-api-key HTTP header.

Getting your API key

Sign in to your sunor dashboard.
Navigate to API Keys.
Click Create API Key and give it a name.
Copy the key immediately — it will only be shown once.

Using your API key

Include the x-api-key header in every request:

curl -X GET https://sunor.cc/api/v1/account/balance \
  -H "x-api-key: YOUR_API_KEY"

import requests

response = requests.get(
    "https://sunor.cc/api/v1/account/balance",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(response.json())

const response = await fetch("https://sunor.cc/api/v1/account/balance", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const data = await response.json();
console.log(data);

Error responses

Status	Meaning
`401`	Missing or invalid `x-api-key` header

Example error response:

{
  "code": 401,
  "error_code": "missing_api_key",
  "message": "Missing x-api-key header"
}

Every public API response includes an X-Request-Id header for correlation. You may send your own safe X-Request-Id value, or let Sunor generate one. Authentication failures occur before an API key’s quota can be read, so an early 401 can omit X-RateLimit-Remaining.

Security tips

Never expose your API key in client-side code. API keys should only be used in server-side applications or secure environments.

Store your API key in environment variables, not in source code.
Rotate keys periodically from the API Keys page.
If you suspect a key has been compromised, delete it immediately and create a new one.
Each key is tied to your account — anyone with the key can use your credits.