Authentication

API Key Authentication

AgenticPencil uses Bearer token authentication with API keys. All API requests must include your API key in the Authorization header.

API Key Format

All AgenticPencil API keys follow this format:

Prefix: ap_
Length: 32 characters after the prefix
Example: ap_1234567890abcdefghijklmnopqrstuv

How to Get Your API Key

Create Account

Verify Email

Check your email and click the verification link

Access API Keys

Navigate to Settings → API Keys in your dashboard

Generate Key

Click “Generate New API Key” and give it a descriptive name

Copy & Store

Copy your key immediately - you won’t be able to see it again!

Making Authenticated Requests

Include your API key in the Authorization header with the Bearer prefix:

curl -X GET "https://api.agenticpencil.com/v1/usage" \
  -H "Authorization: Bearer ap_your_api_key_here"

import requests

headers = {
    "Authorization": "Bearer ap_your_api_key_here",
    "Content-Type": "application/json"
}

response = requests.get(
    "https://api.agenticpencil.com/v1/usage",
    headers=headers
)

const axios = require('axios');

const response = await axios.get(
  'https://api.agenticpencil.com/v1/usage',
  {
    headers: {
      'Authorization': 'Bearer ap_your_api_key_here',
      'Content-Type': 'application/json'
    }
  }
);

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://api.agenticpencil.com/v1/usage');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Authorization: Bearer ap_your_api_key_here',
    'Content-Type: application/json'
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

API Key Management

Multiple Keys

You can create multiple API keys for different use cases:

Development

Use separate keys for development and testing environments

Production

Dedicated keys for your production AI agents

Team Members

Individual keys for team members with different access levels

Third-party Integrations

Separate keys for external services and integrations

Key Rotation

For security best practices, rotate your API keys regularly:

Generate a new API key
Update your applications with the new key
Test that everything works correctly
Revoke the old key

Key Permissions

API keys inherit the permissions of the user who created them. Currently, all API keys have access to:

All endpoint functionality
Credit consumption up to your plan limits
Rate limits based on your subscription tier

Authentication Errors

Common authentication errors and how to resolve them:

401 Unauthorized - Invalid API Key

{
  "error": "Invalid API key",
  "message": "The provided API key is invalid or has been revoked",
  "code": "INVALID_API_KEY"
}

Solution: Double-check your API key format and ensure it starts with ap_

401 Unauthorized - Missing Authorization Header

{
  "error": "Missing authorization",
  "message": "Authorization header is required",
  "code": "MISSING_AUTH_HEADER"
}

Solution: Include the Authorization: Bearer ap_your_key header in your request

403 Forbidden - Expired Key

{
  "error": "API key expired",
  "message": "Your API key has expired. Please generate a new one",
  "code": "EXPIRED_API_KEY"
}

Solution: Generate a new API key from your dashboard

429 Too Many Requests - Rate Limited

{
  "error": "Rate limit exceeded",
  "message": "You have exceeded your rate limit. Please try again later",
  "code": "RATE_LIMIT_EXCEEDED"
}

Solution: Wait before making another request or upgrade your plan for higher limits

Security Best Practices

Never expose your API key in client-side code, public repositories, or logs!

Environment Variables

Store your API key in environment variables:

.env

AGENTICPENCIL_API_KEY=ap_your_api_key_here

Python

import os
api_key = os.getenv('AGENTICPENCIL_API_KEY')

Node.js

const apiKey = process.env.AGENTICPENCIL_API_KEY;

Server-Side Only

Always make API calls from server-side code, never from:

Frontend JavaScript
Mobile app client code
Browser extensions
Public-facing code

Monitor Usage

Regularly check your API usage in the dashboard to detect:

Unexpected spikes in usage
Potential security breaches
API key misuse

Set up usage alerts in your dashboard to get notified when your credit consumption exceeds expected thresholds.

Get Started

Resources

API Key Authentication

API Key Format

How to Get Your API Key

Making Authenticated Requests

API Key Management

Multiple Keys

Development

Production

Team Members

Third-party Integrations

Key Rotation

Key Permissions

Authentication Errors

Security Best Practices

Environment Variables

Server-Side Only

Monitor Usage

​API Key Authentication

​API Key Format

​How to Get Your API Key

​Making Authenticated Requests

​API Key Management

​Multiple Keys

Development

Production

Team Members

Third-party Integrations

​Key Rotation

​Key Permissions

​Authentication Errors

​Security Best Practices

​Environment Variables

​Server-Side Only

​Monitor Usage

API Key Authentication

API Key Format

How to Get Your API Key

Making Authenticated Requests

API Key Management

Multiple Keys

Key Rotation

Key Permissions

Authentication Errors

Security Best Practices

Environment Variables

Server-Side Only

Monitor Usage