Authentication
Send the exact Bearer API-key scheme implemented by SwipeForMovie.
Every route under /v1/* requires an API key. Send the complete key in the HTTP Authorization header:
Authorization: Bearer mov_live_<generated-secret>The API confirms Bearer authentication. It is not cookie authentication and it does not use the SwipeForMovie website session. The documentation site redirects account and sign-in actions to the main application.
Key format
The server accepts keys that match this implementation rule:
^mov_live_[A-Za-z0-9_-]{43,}$Keys generated by the private CLI contain 32 random bytes encoded with base64url after the mov_live_ prefix. Only a SHA-256 hash and a short prefix are stored by the API service.
Public endpoint
GET /health explicitly overrides authentication and is public. Every documented /v1/* endpoint is protected.
Authentication failures
| Status | Code | Meaning |
|---|---|---|
401 | MISSING_API_KEY | The Authorization header is absent. |
401 | INVALID_API_KEY | The scheme, format, or key lookup is invalid. |
403 | API_KEY_DISABLED | The key exists but is inactive. |
429 | MONTHLY_QUOTA_EXCEEDED | The authenticated key exhausted its monthly policy. |
Authentication errors use the standard error envelope. They include X-Request-Id, but the minute-limit headers are not set because these responses occur before minute-limit evaluation.
Security guidance
- Keep API requests in trusted server-side code.
- Load the key from a secret environment variable.
- Never place a live key in public JavaScript, mobile bundles, logs, or URLs.
- Use the returned request ID when investigating a failed request.