Authentication
Authenticate with an API key
Betazu BOS uses API keys to authenticate requests to the API. Keep your key on your server and include it with every authenticated request.
Your API key
When you create an API key in BOS, the secret is displayed only once. Store it securely as an environment variable.
BETAZU_BOS_API_KEY=bz_live_...Authorization header
Send your API key using the HTTP Authorization header with the Bearer authentication scheme.
Authorization: Bearer bz_live_...Example request
The following example sends your API key from a server environment variable.
curl https://www.betazu.com/api/v1/leads \
-H "Authorization: Bearer $BETAZU_BOS_API_KEY"Keep your API key secure
Store the key in a server-side environment variable.
Never commit the key to Git or other source control.
Never expose the key in browser-side JavaScript.
Never include the key in public URLs.
Rotate or revoke the key if you believe it has been exposed.
Environment variables
Your application can read the key from the server environment instead of placing the secret directly in source code.
const apiKey = process.env.BETAZU_BOS_API_KEY;Keep this code on your server. Do not expose the secret through a public client-side environment variable.
Invalid or revoked keys
Requests made with an invalid, revoked, or expired API key will not be authenticated. If authentication starts failing, check that the correct key is configured and that it has not been revoked or expired.