API Authentication

ExplainThis uses API keys to verify each request. Include your key in every call to reach the service endpoints.

An API key proves you are who you say you are. Without one, the server will reject your request. Think of it like a password that your code sends along with every call.

Using Your Access Key

Now that you have a key, you need to send it with every request. Add it to your request headers so the server knows who is calling. You can use either the X-API-Key header or the Authorization: Bearer format. Both work the same way.

Below are examples in three popular languages. Copy any of them and replace your_api_key_here with your real key.

curl -X POST https://explainthiscode.ai/api/explain \
  -H "X-API-Key: your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"code": "function hello() { return 'world' }"}'

const response = await fetch('https://explainthiscode.ai/api/explain', {
  method: 'POST',
  headers: {
    'X-API-Key': 'your_api_key_here',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    code: 'function hello() { return "world" }',
  }),
});

import requests

response = requests.post(
    'https://explainthiscode.ai/api/explain',
    headers={
        'X-API-Key': 'your_api_key_here',
        'Content-Type': 'application/json',
    },
    json={
        'code': 'function hello() { return "world" }',
    },
)

Environment Variables

Hard-coding a key in your source files is risky. If someone reads your code, they also get your key. Environment variables keep it separate and safe. Here is the recommended approach:

EXPLAINTHIS_API_KEY=your_api_key_here

Access Key Best Practices

Following these habits will help you avoid leaks and stay secure:

• Keep your key private at all times.
• Store it in environment variables, not in source files.
• Create fresh keys on a regular schedule. Old keys are a bigger target.
• Use separate keys for development and production. That way, a leak in one does not affect the other.
• Check your usage stats in the dashboard regularly. A sudden spike may mean someone else is using your key.
• Be mindful of rate limits — each plan has a set quota per minute. Design your integration to handle 429 responses gracefully.

Once authenticated, explore the available endpoints to start building your integration.