Auth & API keys

Every request to the submit endpoint needs an API key. Pass it in one of three ways:

• Header (preferred): x-api-key: fr_live_...
• Bearer fallback: Authorization: Bearer fr_live_...
• Form field (no-JS HTML forms): a hidden _api_key input. Plain forms can't set headers. The field is stripped before the payload is stored, but it is visible in your page source. Browser fetch also exposes the key. Use a server proxy to keep it private.

Keys start with fr_live_ followed by 22 URL-safe characters. Only the SHA-256 hash is stored server-side. You can rotate or revoke a key any time from /app/keys. Rotating creates a new key; the old one stops working immediately.