Authentication

One header, one key. No OAuth, no session, no cookies.

Send your key in the X-API-Key header on every request:

curl 'https://api.enricho.io/v1/company?universalName=google' \
  -H 'X-API-Key: YOUR_API_KEY'

A Bearer token in the Authorization header also works, because plenty of HTTP clients default to it:

curl 'https://api.enricho.io/v1/company?universalName=google' \
  -H 'Authorization: Bearer YOUR_API_KEY'

Key format

Keys look like enr_live_ followed by 40 random characters. Only a SHA-256 hash and a short lookup prefix are stored, so the full value exists exactly once — in the response to the request that created it.

Rotating a key

Roll in the dashboard issues a replacement and revokes the old one. Deploy the new key first, then confirm — revocation takes effect on the very next request.

If a key leaks

Revoke it immediately. Anyone holding a key can spend your account's balance; there is no IP allowlist, and the prepaid balance is the hard ceiling on the damage.

Give each application, and each AI agent, its own key. Then revoking one thing does not take down everything else you run.

What we never ask for

We never ask for your LinkedIn credentials or session cookies, and we never act as you. Your own LinkedIn account is not involved at any point.