Authentication
Every request carries an API key, in either of two headers.
Send your key
Send your key as a bearer token, or in x-api-key — whichever your HTTP client or SDK already uses:
Authorization: Bearer ts_live_…x-api-key: ts_live_…Both are accepted on every endpoint, including the compatibility layers, so the official Exa, Tako and Perplexity SDKs work without changes.
With the SDKs
The SDKs read TYPESEARCH_API_KEY from the environment. Pass the key explicitly to override it:
import Typesearch from 'typesearch-js';
const ts = new Typesearch(); // TYPESEARCH_API_KEY
const other = new Typesearch({ apiKey: process.env.OTHER_KEY });Keep keys on the server
A key authorises spending on your account. Call typesearch from your backend or your agent’s runtime, never from a browser or a mobile app, and keep keys out of version control.
We store a hash of each key, never the key itself: it is shown once, when you create it. If a key leaks, revoke it and create a new one.
Errors
| Status | code | What it means |
|---|---|---|
| 401 | missing_api_key | Neither header was sent. |
| 401 | invalid_api_key | The key does not exist or is malformed. |
| 401 | revoked_api_key | The key was revoked. Create a new one. |
See Errors for the error format and every other code.