Authentication

Authenticate requests with an organization-scoped Unkey API key.

Send your CinemaData key as an HTTP bearer credential:

Authorization: Bearer cd_live_YOUR_API_KEY

The Unkey Gateway verifies the key, applies the configured request rate limit, and supplies a trusted organization principal to the API. The application then checks that organization’s local paid-through subscription projection before returning commercial data.

Key handling

• Keys belong to an organization, not an individual user.
• A new secret is displayed once and is never stored by CinemaData.
• Keep keys in a server-side secret manager.
• Never expose a key in browser code, URLs, logs, screenshots, or support messages.
• Revoke a compromised key in the customer portal and create a replacement.

The public /health operation does not require a key. Every /v1 operation does.