How authentication works
All Bunny API endpoints use API key authentication only. Include theX-API-Key header in every request.
Where to send the key
All requests go to the same base URL (
https://api.bunny.build/api/v1). The environment or plan is determined by the API key you use.Authentication errors
The API returns HTTP
401 when:- The API key is missing from the header
- The key is invalid
- The key has been revoked
Getting an API key
- Sign in to the Bunny Dashboard
- Complete your profile if prompted
- Create an API token and copy it. It is shown only once
- Store the key in a secure place (e.g. environment variables or a secrets manager)
Security best practices
- Store keys in environment variables or a secrets manager
- Never commit API keys to version control or expose them in client-side code
- Bunny will never ask for your key
- Revoke any key that may have been compromised

