Skip to main content
MaxAPI authenticates requests with API keys. Most endpoints expect a Bearer token in the Authorization header:
Some provider-native endpoints use a different authentication format. Follow the header definition on the endpoint page.

Protect your keys

  • Store API keys in server-side environment variables or a secrets manager.
  • Do not include keys in frontend code, mobile applications, or public repositories.
  • Create separate keys for each application and environment.
  • Revoke and replace a key immediately if you suspect exposure.

Authentication errors