Authentication

Every request to the content API is authenticated with a project API key:

Authorization: Bearer pk_live_xxxxxxxxx

Key lifecycle

Property	Behaviour
Prefix	pk_live_ for production keys
Storage	Hashed with SHA-256; plaintext is never persisted
Visibility	Shown exactly once, at creation
Scope	A single project — keys cannot read across projects
Revocation	Immediate, from Project → Settings → API keys

Verifying a key

curl https://api.pagekit.app/v1/me \
  -H "Authorization: Bearer pk_live_xxxxx"

{
  "project": { "id": "proj_123", "name": "Acme Blog", "slug": "acme-blog" },
  "apiKeyId": "key_123",
  "posts": { "published": 12, "draft": 4, "scheduled": 2 }
}

Errors

Status	Meaning
401	Missing, malformed, revoked, or expired key
403	Key valid, resource belongs to another project
429	Project rate limit exceeded

Keep keys server-side. Never ship a pk_live_ key to the browser.