What your partners' developers get.

A sandbox key, shown once.

Copy it when it appears. Spectrum keeps a hash, so nobody can show it to you again.

Keys go in the Authorization header.

Sample request

curl https://api.your-domain.example/api/v1/<product>/... \
  -H "Authorization: ApiKey <sandbox-key>"

Production gets its own key.

Developers browse the catalog and read the API docs in the portal, then request access to the API products they need. Your team approves or rejects each request.

You set the hourly limit.

Each API product has an hourly limit, and each partner has its own count. Run out and the API answers with a 402 and says when to retry.

Sample response at the limit

HTTP/1.1 402
X-Quota-Remaining: 0
Retry-After: <seconds>

{ "title": "QUOTA_EXHAUSTED", ... }