Guide

Authentication and API keys

Create, store, restrict and rotate API keys safely

Updated 2026-07-13View as Markdown

Create a key

The protected dashboard is the only place to manage keys. Open API key settings, choose Test or Live mode and grant only the permissions you need

Send the key

Send the key in each request with Authorization: Bearer <api-key>. Requests without a valid key return a stable JSON error envelope

curl https://alef-bot.top/api/v1/account \
  --header "Authorization: Bearer $ALEFBOT_API_KEY" \
  --header "Accept: application/json"

const response = await fetch("https://alef-bot.top/api/v1/account", {
  headers: {
    Authorization: `Bearer ${process.env.ALEFBOT_API_KEY}`,
    Accept: "application/json",
  },
});

if (!response.ok) throw new Error(`AlefBot request failed: ${response.status}`);
const account = await response.json();

import os
import requests

response = requests.get(
    "https://alef-bot.top/api/v1/account",
    headers={"Authorization": f"Bearer {os.environ['ALEFBOT_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
account = response.json()

Permissions and key rotation

Use read_only for tracking and reports only
Use full_access only in systems that upload media or create jobs
Create a replacement key, deploy it, confirm it is in use, then revoke the old key