Skip to navigation
Releases

2026-10-22 — API key in the X-Api-Key header

Added

X-Api-Key header

Every endpoint that takes the api_key parameter now also accepts the key in the X-Api-Key request header:

curl -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json" \
  "https://app.dealsignal.com/api/v1/users/credit_metrics"
  • The header is the preferred way: it keeps the key out of URLs, which can end up in logs and browser history.
  • The api_key parameter keeps working as before, in the query string and, where documented, in the JSON body. If a request carries both, the parameter is used, even an empty api_key=: remove api_key from the URL (or the JSON body) when you switch to the header.
  • On POST /api/v1/auth/api_keys/roll, keep sending the key in the request body.
  • Authentication errors are unchanged: an unknown key returns 401 with { "message": "Invalid api key" }.

See Authentication.

Changed

Key-roll error text

The 400 that POST /api/v1/auth/api_keys/roll returns for a key in the query string now reads: “API key must be supplied in the request body or the X-Api-Key header, not as a query string parameter, for this endpoint.” Keep sending the key in the request body on this endpoint, and match on the status code, not the text.

Notes for clients

  • Integrations that can set request headers (HTTP clients, workflow tools) can move the key from the URL to X-Api-Key.