Skip to content
Viralmaxing Logo
Documentation
On this page
X-API-Key headerBearer tokenStorage and rotationAccess errors

REST API authentication

An API key starts with vmx_ and grants access to one workspace. Send it with every request in one of two ways.

X-API-Key header

http
X-API-Key: vmx_...

This is the primary and most explicit option.

Bearer token

http
Authorization: Bearer vmx_...

Both headers are accepted equally. Do not send them together.

Storage and rotation

  • keep the key in a secret manager or environment variable;
  • create a separate key for each integration;
  • review its last-used date in settings;
  • delete it after a leak, ownership change, or integration shutdown.

Deletion revokes access immediately. A lost key cannot be recovered. Create a replacement and delete the old key.

Access errors

401 means that the key is missing, invalid, expired, or revoked. 403 means the key is valid, but the user's workspace role does not allow the operation.

Read next

REST API quick start Create an API key, store it in an environment variable, and make the first request.Your first REST request Verify a key with cURL or server-side JavaScript and handle common API responses.