How do I authenticate requests?

Pass your API key as a Bearer token in the Authorization header: Authorization: Bearer vat_live_.... The authentication guide has full request examples and the error responses for a missing or revoked key. You manage keys — creating, naming, and revoking them — entirely from the dashboard. Never expose a live key in client-side code; keep it server-side.