Authentication

All API requests require authentication via a Bearer token. You can generate API keys from your dashboard settings.

API keys

API keys are secret tokens that identify your account. Keep them secure and never expose them in client-side code or public repositories.

Key format

pk_pico_<random_alphanumeric>

Sending the token

Include your API key in the Authorization header of every request:

Authorization: Bearer pk_pico_your_key_here

Security best practices

  • Use environment variables — Store your API key in PICO_API_KEY or similar, never hardcoded.
  • Rotate keys regularly — Generate new keys from the dashboard and revoke old ones.
  • Scope your keys — Create separate keys for development, staging, and production.
  • Never commit keys — Add .env and *.key to your .gitignore.

Next: API reference

Explore available endpoints and response formats.

Read