Authentication

All API requests require an API key in the Authorization header.

Header format

Authorization: Bearer chow_live_YOUR_KEY

Key prefixes

Prefix	Environment	Usage
`chow_live_`	Production	Live API calls, billed via credits
`chow_test_`	Testing	Local development, not metered

Getting started

Credit packs: $5/5K calls (Dev), $20/25K calls (Builder), $50/100K calls (Scale). Need higher volume? Contact us at hello@chowapi.dev for custom pricing.

Key management

Authenticated users (via Supabase JWT) can create, rename, and revoke API keys:

# Create a new key
POST /v1/account/keys
{ "name": "My App" }

# Rename a key
PATCH /v1/account/keys/{key_id}
{ "name": "Production" }

# Revoke a key
DELETE /v1/account/keys/{key_id}

Each account can have up to 5 active keys. API keys are hashed with SHA-256 before storage. The plaintext key is shown only once at creation.

Error responses

// Missing or invalid key
{
  "error": {
    "code": "auth/missing_key",
    "message": "No API key provided.",
    "suggestion": "Add an Authorization header: Bearer chow_live_YOUR_KEY",
    "docs": "https://chowapi.dev/docs/authentication"
  }
}