Kundli.
Draw
API guides

Authentication

Every request carries your secret API key in the X-API-Key header. No OAuth dance, no token refresh — one header, every endpoint.

Step 1

Create a key

Keys live in your dashboard and take seconds to mint.

  1. Sign in and open Developers → API Keys.
  2. Give the key a name (e.g. production-ios) and create it.
  3. Copy the key once — it is shown a single time and stored hashed afterwards.

Keys look like kundli_abc123.... Treat them like passwords: server-side only, never in client bundles, mobile apps, or public repos.

Step 2

Send the header

The same header authenticates all 21 endpoints.

Header format
X-API-Key: kundli_abc123...

GET https://api-rho-eight-42.vercel.app/api/v1/vedic/panchangam?date=2026-10-15&lat=9.9312&lon=76.2673
X-API-Key: kundli_abc123...
cURL
curl "https://api-rho-eight-42.vercel.app/api/v1/numerology/" \
  -H "X-API-Key: kundli_abc123..." \
  -H "Content-Type: application/json" \
  -d '{"full_name": "Aarav Sharma", "birthdate": "1990-05-15"}'

Missing or invalid keys return 401 Unauthorized with a machine-readable error body. Keys can also be managed from the developers dashboard.

Step 3

Rotate without downtime

  1. Create a new key alongside the old one — both work during the transition.
  2. Deploy the new key to your servers.
  3. Confirm traffic on the new key, then revoke the old one.

Revoked keys stop working immediately. If a key ever leaks, revoke it first and rotate second — a fresh key is one click away.

Good hygiene

Key best practices

One key per environment

Separate keys for development, staging and production make leaks easy to contain.

Server-side only

Call the API from your backend. Keys in browser JS or mobile binaries will be harvested.

Name keys clearly

production-web, staging-worker — future you will thank present you during an incident.

Rotate yearly

Even uncompromised keys deserve a birthday. Rotation takes a minute and costs nothing.

Back to the reference