Skip to main content
The Moderation API uses API keys to authenticate requests. There are two kinds of keys: Each project has its own project keys. A project key can’t call the management API. An organization key can call a project’s endpoints when it names the project in the Project-Id header (projectId in the SDKs). See Call project endpoints. Both kinds can call Get account details. You manage keys in the dashboard. Your API keys carry many privileges, so be sure to keep them secure. Don’t share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth. Authentication to the API is performed with the Authorization header when making a HTTP request. Provide your API key prefixed with Bearer as the value of the Authorization header.
You must make all API calls over HTTPS. Calls that you make over plain HTTP will fail. API requests without authentication will also fail.
We recommend creating two projects in your dashboard, one for development and one for production. This way you can create tokens for both environments.