Skip to main content
Every request to the Braintest API must include a valid API key in the API-KEY header. This page explains how to obtain your key, how to send it, and how to handle authentication errors.

​
Obtaining your key

  1. Log in to the Braintest organizer panel.
  2. Navigate to Settings > API Keys.
  3. Generate a new key. Copy it and store it securely. Braintest does not show it again.
Treat your API key like a password. Do not commit it to version control, expose it in client-side code, or share it in public repositories.

​
Sending the key

Include the API-KEY header on every request, regardless of HTTP method.

​
Authentication errors

The API returns specific HTTP status codes and envelope messages for authentication problems. Example 401 response:

​
Key lifecycle

  • Expiration: Keys can be set to expire after a specific date. Expired keys return 403.
  • Revocation: An organizer admin can revoke a key at any time. Revoked keys return 403.
  • IP allowlist: Keys can be restricted to specific IP addresses. Requests from other IPs return 403.
Rotate your API keys periodically. Generate a new key in the organizer panel, update your integration, and revoke the old key.

​
Security best practices

  • Store the key in environment variables or a secrets manager, never in source code.
  • Do not expose the API-KEY header in browser-side JavaScript or mobile app code. Route requests through your backend.
  • Use HTTPS for all API calls. The Braintest API rejects plain HTTP requests.