Authentication

All Brilo API requests are authenticated using an API key passed in the request header. There are no OAuth flows or session tokens — every request is stateless and self-contained.

Your API Key

Find your API key in the dashboard under Settings → Developer Settings.

Sending the API Key

Pass your key in the X-API-KEY header on every request:

curl https://api.brilo.tech/api/customers/ \
  -H "X-API-KEY: your-api-key"

All requests without a valid key return 401 Unauthorized.

Keeping Keys Secure

Do:

• Store keys in environment variables or a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.)
• Use different keys per environment (production vs. staging)
• Rotate keys immediately if you suspect they've been exposed

Don't:

• Hardcode keys in application code
• Put keys in frontend/client-side JavaScript
• Log keys in application logs
• Commit keys to version control (even in private repos)

Example: Loading from environment

import os
import requests

api_key = os.environ["BRILO_API_KEY"]

response = requests.get(
    "https://api.brilo.tech/api/customers/",
    headers={"X-API-KEY": api_key}
)

const apiKey = process.env.BRILO_API_KEY;

const response = await fetch("https://api.brilo.tech/api/customers/", {
  headers: { "X-API-KEY": apiKey }
});

Rotating Your API Key

If a key is compromised or you want to rotate it as a security practice:

1. Go to Settings → Developer Settings
2. Click Generate New Key
3. Update your environment variables or secrets manager with the new key
4. The old key is immediately invalidated

Next Steps