Authentication
All Shim API requests require an API key passed in theAuthorization header.
Getting Your API Key
1
Sign up
Create a free account at console.shim.so/signup
2
Navigate to Console
Go to console.shim.so
3
Generate Key
Click “API Keys” -> “Create Your First Key”
4
Copy and Store
Copy the key immediately. We do not store the full key.
Using Your API Key
Include your API key in theAuthorization header as a Bearer token:
Example Request
Key Format
- Production keys:
sk_live_xxxxx - Test keys:
sk_test_xxxxx(coming soon)
Rate Limits by Tier
See Rate Limits for overage behavior.
Security Best Practices
Rotate keys regularly
Rotate keys regularly
Generate a new key every 90 days. Delete old keys immediately.
Use environment variables
Use environment variables
Never hardcode keys in source code. Use
.env files (gitignored).Restrict key scope
Restrict key scope
Create separate keys for development, staging, and production.
Monitor usage
Monitor usage
Check your console for unexpected spikes in usage.
Troubleshooting
All responses return HTTP 200. Errors are in the response body undermetadata.errors.
INVALID_API_KEY / MISSING_API_KEY
Cause: Invalid, missing, or revoked API key Fix: Check that your key is correct and included in theAuthorization header. Check success: false and metadata.errors[0].code in the response body.
RATE_LIMIT_EXCEEDED
Cause: Per-minute rate limit exceeded Fix: Implement exponential backoff or upgrade your tier. CheckX-RateLimit-Reset header for when the window resets.
See Troubleshooting for more common issues.