API keys

Create a key from dashboard settings. Send it on every request as an Authorization bearer token. The x-binhtml-api-key header is also accepted if a client makes bearer tokens awkward.

Keys authenticate as your account, so anything a key can do, the holder of that key can do.

In a secret store: CI secrets, your shell environment, or your agent client's credential configuration.

Not in a prompt, not in a committed file, not in the HTML you are publishing. An agent that can read your key can also leak it into a generated document, which is a good reason to scan output before it goes out.

Delete it in dashboard settings and issue a new one. Then check what was published while it was live, because a key that leaked could have been used to create artifacts under your account.

Publishing is rate limited per account. Exceeding the limit returns a rate limit error with headers describing the window so a client can back off and retry rather than hammering the endpoint.