Authentication

Obtaining, using and rotating an API key.

API keys

Every request carries an API key. REST interfaces take it in a header:

Authorization: Bearer wt_live_xxxxxxxxxxxxxxxx

WebSocket connections pass it as a query parameter during the handshake:

wss://api.winteam.tech/v1/stream?token=wt_live_xxxxxxxxxxxxxxxx

Environments

EnvironmentPrefixNotes
Testwt_test_Free quota; results carry a watermark
Productionwt_live_Billed

Keeping keys safe

  • Never put a key in front-end code or commit it to a repository
  • For browser clients, have your server issue a short-lived token rather than handing out a long-lived key
  • Rotate periodically; a retired key keeps working for a 24-hour grace period