Authentication

Every authenticated Public v1 request needs one active Customer API Key. Send it as an HTTP bearer credential:

curl "https://api.envoapi.com/v1/profiles/details/by-username?username=<PROFILE_USERNAME>" \
  --header "Authorization: Bearer $ENVO_API_KEY" \
  --header "Accept: application/json"

Send exactly one Authorization: Bearer <ENVO_API_KEY> header. Other authentication headers are not supported. Do not put an API Key in a URL, query string, request body, or cookie.

Call EnvoAPI from your server

An API Key grants access on behalf of its Customer Account. Keep it in a server-side environment variable or secrets manager; never ship it in browser or mobile application code.

export async function getProfile(username: string) {
  const url = new URL("https://api.envoapi.com/v1/profiles/details/by-username");
  url.searchParams.set("username", username);

  const response = await fetch(url, {
    headers: {
      accept: "application/json",
      authorization: `Bearer ${process.env.ENVO_API_KEY ?? ""}`,
    },
  });

  return response.json();
}

The same pattern in Python:

import os

import requests


def get_profile(username: str):
    response = requests.get(
        "https://api.envoapi.com/v1/profiles/details/by-username",
        params={"username": username},
        headers={
            "Accept": "application/json",
            "Authorization": f"Bearer {os.environ['ENVO_API_KEY']}",
        },
        timeout=30,
    )
    return response.json()

Diagnose a 401

A missing, malformed, unknown, or inactive API Key returns 401 with the standard error envelope:

{
  "error": {
    "code": "invalid_api_key",
    "message": "The API Key is invalid.",
    "retryable": false,
    "details": []
  },
  "meta": {
    "requestId": "request-example"
  }
}

When a request unexpectedly returns 401, check that:

• the Authorization value begins with Bearer and contains the key after the space;
• the environment variable is present and has no surrounding whitespace or trailing line break; and
• every HTTP client used by the application adds the credential header.

Log whether a credential was present, never its value. If a key leaks, revoke or rotate it immediately and update the server environment. All API Keys on a Customer Account share that Account’s access and rate limit.