Authentication

All SheetsAPI requests are authenticated with a Bearer token passed in the Authorization header:

Authorization: Bearer sk_...

Endpoints are public by default until you create your first API key in the dashboard. The moment a key exists for your account, every request must carry a valid token - unauthenticated requests receive a 401 Unauthorized response.

Generating an API key

1. Open the SheetsAPI dashboard.
2. Go to Settings → API Keys.
3. Click New key, give it a name, and choose an environment (Live or Test).
4. Copy the key immediately - it is shown in full only once.

Keep one key per environment. A dedicated test key means you can rotate your production key without touching your staging pipeline, and vice versa.

Including the token in requests

HTTP header

Add the Authorization header to every request:

Authorization: Bearer sk_live_abc123

curl

curl https://sheetsapi.gkit.mreshank.com/api/spreadsheets/{userKey}/Contacts \
  -H "Authorization: Bearer sk_live_abc123"

JavaScript (fetch)

const res = await fetch(
  `https://sheetsapi.gkit.mreshank.com/api/spreadsheets/${USER_KEY}/Contacts`,
  {
    headers: {
      Authorization: `Bearer ${process.env.SHEETS_API_KEY}`,
    },
  },
);
const { data } = await res.json();

Python (httpx)

import httpx
import os
 
client = httpx.Client(
    headers={"Authorization": f"Bearer {os.environ['SHEETS_API_KEY']}"}
)
 
response = client.get(
    f"https://sheetsapi.gkit.mreshank.com/api/spreadsheets/{USER_KEY}/Contacts"
)
response.raise_for_status()
data = response.json()["data"]

Key prefixes

Use sk_test_ keys in non-production environments so accidental writes never touch live data.

Security best practices

Store keys in environment variables, never in source code. A key committed to a repository - even briefly - should be treated as compromised. Use .env files locally and your host's secret manager in production.

# .env (add to .gitignore)
SHEETS_API_KEY=sk_live_abc123

Restrict by IP or domain. The dashboard lets you lock a key to a list of allowed IP addresses or origin domains. A key scoped to app.yoursite.com cannot be replayed from another origin even if it is leaked.

Rotate keys that may have been exposed. Go to Settings → API Keys, find the affected key, and click Revoke. The old key stops working immediately. Generate a replacement, update your environment variables, and redeploy.

Error responses

{
  "error": "Unauthorized",
  "message": "Missing or invalid API key.",
  "status": 401
}

See Error Handling for the full list of status codes and retry guidance.

Expiry and rotation

API keys do not expire automatically. A key remains valid until you revoke it from the dashboard. For long-running production integrations, rotate keys on a schedule (quarterly is a common baseline) even without a suspected compromise.

To rotate:

1. Generate a new key in Settings → API Keys.
2. Update the key in your environment without downtime - most platforms support staged secret rollouts.
3. Verify requests are succeeding with the new key.
4. Revoke the old key.

Revocation is instant - there is no grace period.