Authentication

API key creation, permissions, rate limits, and security best practices.

Overview

Every API request requires a Bearer token. Keys are scoped to your organization and carry specific permissions.

API Key Format

Format: aeo_live_ prefix + 32 hexadecimal characters
Example: aeo_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
Only the SHA-256 hash is stored server-side
The full key is shown exactly once at creation time

bash

Authorization: Bearer aeo_live_a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4

Creating a Key

Log in at studio.aeocontent.ai
Navigate to API Keys tab
Click "Create API Key"
Complete SMS verification (2FA required)
Copy and store the key securely

API access is included with the Business plan (Business and Business Plus). A key reads the domains its account owns or is a member of that are on the Business plan or higher. A member domain below Business gets a 403 with code plan_required, naming the Business plan; a domain the account is not a member of gets a 403 with code forbidden.

Permissions

Every endpoint today is a GET that needs the read permission (keys get it by default). write is kept for endpoints that change things; none does yet.

Rate Limits

Limits per key, on the Business plan:

Name	Type	Required	Description
`Per minute`	limit	Optional	60 requests in any rolling minute
`Per day`	limit	Optional	2,000 requests in any rolling 24 hours

Rate limit headers returned with every authenticated response:

bash

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
X-RateLimit-Reset: 1791648060

X-RateLimit-Limit: the limit of the window closer to running out, per minute or per day
X-RateLimit-Remaining: requests left in that window after this one
X-RateLimit-Reset: Unix time, in seconds, by which that window has fully refilled

When rate limited, the API returns 429 Too Many Requests with a Retry-After header: the number of seconds until the next request is allowed. Browser callers can read all four headers.

Error Responses

json

{
  class="code-string">"error": {
    class="code-string">"code": class="code-string">"unauthorized",
    class="code-string">"message": class="code-string">"Invalid or missing API key"
  }
}

Common error codes:

401: Missing or invalid API key
403: The key's account is not a member of the domain (code forbidden), or a member domain is not on the Business plan or higher (code plan_required)
429: Rate limit exceeded (code rate_limit_exceeded), with Retry-After

Security Best Practices

Store keys in environment variables, never in source code
Use separate keys for development and production
Rotate keys periodically - revoke old keys at studio.aeocontent.ai
Never expose keys in client-side JavaScript or public repositories

If you suspect a key has been compromised, revoke it immediately at studio.aeocontent.ai and create a new one.