The Axro API is a REST API you authenticate with an API key. Keys are scoped to your account and the products you have access to, so a key created for a Discord bot cannot touch your Minecraft plugin endpoints unless you grant it.
Getting a key
Create a key from the developer dashboard. Each key has a name, a set of scopes, and an optional expiry. We recommend one key per service rather than sharing a single key across everything — it makes rotation and audit much simpler.
Sending it
- ▸Send the key in the Authorization header as a Bearer token
- ▸Keep the key server-side — never ship it inside client code
- ▸Rotate keys immediately if one ever leaks
Common mistakes
The most common failures are using the wrong key type, missing the Authorization header, and hitting rate limits without handling the Retry-After header. Check the error body — it tells you exactly which of those happened.
