Authentication
Conversion endpoints require a Bearer API key. Discovery endpoints
(/v1/categories,
/v1/units,
/v1/health,
/openapi.json) are public.
Authorization header
Authorization: Bearer uu_live_xxxxxxxxxxxxxxxxxxxxxxxxxx
uu_live_ prefix and contain 32
cryptographically random bytes. Treat them like passwords.
Endpoint access table
| Endpoint | Authentication |
|---|---|
GET /v1/convert | Bearer |
POST /v1/convert | Bearer |
POST /v1/batch | Bearer |
POST /v1/parse | Bearer |
POST /v1/normalize | Bearer |
GET /v1/currency/convert | Bearer |
POST /v1/currency/convert | Bearer |
GET /v1/currency/rates | Bearer |
GET /v1/substances | Bearer |
GET /v1/substance/convert | Bearer |
POST /v1/substance/convert | Bearer |
POST /v1/unit-price | Bearer |
GET /v1/categories | Public |
GET /v1/categories/:category | Public |
GET /v1/units | Public |
GET /v1/units/:unit | Public |
GET /v1/health | Public |
GET /openapi.json | Public |
Key rotation
Each account has one active API key. Rotating it revokes the previous
key immediately, so requests that still use the old key start failing
with INVALID_API_KEY. Revocation and
plan changes can take up to 60 seconds to reach every edge location.
- Open your API keys page and rotate the key
- Copy the new key; it is shown only once
- Update the secret in your deployment and redeploy
- Verify traffic is flowing correctly
Because a key cannot be shared safely between environments, use a separate account for staging or development if you need an isolated key. Never reuse a key across production and development.
Account and API keys
Sign in with Google to manage your account. Each page covers one task:
- Profile: display name and sign out
- API keys: create, rotate, or revoke your key
- Usage & billing: plan, monthly quota, 30-day usage, and billing