Authentication

Two different credentials, for two different callers.

API keys — for the widget and public integrations

Your API key (shown at exactcalcs.com/dev) identifies your account to /v1/widget/verify, /v1/widget/register-domain, and anywhere else a third-party page or integration calls ExactCalcs directly. It's passed as a field in the request body, not a header — matching how the widget itself sends it:

{ "apiKey": "sk_live_...", "domain": "https://yoursite.com", "calcId": "bmi" }

This key is meant to be public — it's embedded in your page's own HTML (data-api-key="..."), and anyone viewing the page source can read it. That's fine: access control comes from domain registration and your account's usage quota, not from the key being secret.

Account session (JWT) — for managing your account

Signing in at exactcalcs.com/dev returns a JWT, sent as a Bearer token to routes that manage your account directly — POST/DELETE /v1/domains, GET/PUT /v1/widget-config/:calcId (which is how a webhook gets configured):

Authorization: Bearer <your JWT>

Unlike the API key, this token is a real credential — don't embed it in a public page. It's meant for the dashboard itself, or a server-side script acting on your behalf.