Skip to main content
The Vook API authenticates with an API key. You mint keys from the Vook web app, then send the key as a Bearer token on every request.

​
Mint a key

You create keys from the API Keys page in the Vook web app, so there is nothing to deploy or configure first. Your account must have API access enabled. Give the key a name, and the app shows you a vk_live_… value once. Copy it immediately and store it somewhere safe, since you cannot retrieve it again. Alongside the key, the app shows a webhook signing secret, also only once. You use it to verify that webhook requests come from Vook (see Verify the signature). Store it with the key. It only verifies deliveries, so it cannot authenticate API requests.

Get an API key

Open the API Keys page in the Vook web app to create and manage your keys.

​
Store the key

Export the key as an environment variable so the examples in these guides can read it:

​
Send the key

Send the key as a Bearer token in the Authorization header on every request:

​
Key lifecycle

  • Keys expire one year after they are created.
  • Revoke a key at any time from the API Keys page in the web app.
  • A revoked or expired key is rejected on the next request, so mint a new one to continue.
  • Revoking a key stops new requests with it. Jobs it already submitted still run to completion.
  • A signing secret belongs to its key and cannot be rotated on its own. If the secret leaks, mint a new key and revoke the old one.
Treat vk_live_… keys like passwords. Do not commit them to source control or expose them in client-side code. If a key leaks, revoke it and mint a new one.