Xiaoku authentication ​

Public Xiaoku endpoints use a Bearer token in the Authorization header.

http
Authorization: Bearer <API_KEY>

Recommendations ​

  • Store keys on the server. Do not put them in frontend code.
  • Use a separate key per product or environment so you can audit and isolate traffic.
  • Rotate keys on a schedule.

Common authentication failures ​

  • The header is missing or malformed.
  • The token is invalid, expired, or disabled.
  • The caller is not on the allowlist, if your gateway enforces one.