Authentication¶
Every request to the Fetchmeta API must be authenticated with an API key.
API keys¶
Fetchmeta keys are created and managed from the Zindle dashboard, under the Fetchmeta tab in API Keys. Keys use the format:
The key is shown once, at the moment of creation. Fetchmeta stores only a hash of your key — it cannot be retrieved or displayed again. If you lose a key, revoke it and create a new one.
Using your key¶
Pass the key in the X-API-Key request header on every call:
curl "https://fetchmeta.zindle.com.au/v1/fetch?url=https://example.com" \
-H "X-API-Key: fm_live_your_key_here"
Requests without a valid key receive a 401 Unauthorized response.
Managing keys¶
From the Fetchmeta tab in the dashboard you can:
- Create a new key with an optional descriptive name
- List your active keys (showing the prefix, name, creation date, and last-used time)
- Revoke a key — revocation is immediate
You can hold multiple keys at once, which is useful for separating environments (development, staging, production) or rotating keys without downtime.
Security best practices¶
- Treat your API key like a password. Never commit it to source control or expose it in client-side code.
- Use a separate key per application or environment so you can revoke one without affecting others.
- Rotate keys periodically — create the new key, deploy it, then revoke the old one.
- If a key is ever exposed, revoke it immediately from the dashboard.
Key scope¶
Each key is tied to your Zindle account. Usage and rate limits apply per account, across all of your keys.