Migration Guide

Header Authentication Migration Guide

Move from the legacy X-API-Key header to the standard Authorization: Bearer format with zero downtime.

1) Header format change

Keep the same API key value. Only the header name and value format change. This aligns your integration with OpenAPI-standard bearer authentication.

text
# Legacy (deprecated)
Header name: X-API-Key
Header value: <YOUR_API_KEY>
 
# Standard (canonical)
Authorization: Bearer <YOUR_API_KEY>

2) Update requests in each language

Endpoint paths stay service-first (/api/v1/<service>/<action>). Only auth header handling changes.

TypeScript / JavaScript (fetch)

typescript
const response = await fetch(
  "https://khaleejiapi.dev/api/v1/email/[email protected]",
  {
    headers: {
      Authorization: "Bearer <YOUR_API_KEY>",
    },
  }
)

Python (requests)

python
import requests
 
response = requests.get(
    "https://khaleejiapi.dev/api/v1/email/validate",
    params={"email": "[email protected]"},
    headers={"Authorization": "Bearer <YOUR_API_KEY>"},
)

Go (net/http)

go
req, err := http.NewRequest(
  "GET",
  "https://khaleejiapi.dev/api/v1/email/[email protected]",
  nil,
)
if err != nil {
  panic(err)
}
req.Header.Set("Authorization", "Bearer <YOUR_API_KEY>")

PHP (cURL / stream headers)

php
$headers = [
  "Authorization: Bearer <YOUR_API_KEY>",
  "Content-Type: application/json",
];

Swift (URLRequest)

swift
var request = URLRequest(
  url: URL(string: "https://khaleejiapi.dev/api/v1/email/[email protected]")!
)
request.setValue(
  "Bearer <YOUR_API_KEY>",
  forHTTPHeaderField: "Authorization"
)

Kotlin (OkHttp)

kotlin
val request = Request.Builder()
  .url("https://khaleejiapi.dev/api/v1/email/[email protected]")
  .addHeader("Authorization", "Bearer <YOUR_API_KEY>")
  .build()

3) Roll out safely

  • Update one service at a time to send Authorization: Bearer.
  • During migration, monitor auth responses for deprecation warnings on legacy clients.
  • Keep key rotation and storage policies unchanged — only header transport changes.

4) Troubleshooting 401 / 403

401 Unauthorized

  • Missing Bearer prefix in Authorization value.
  • Using a masked dashboard value instead of the full key.
  • Sending a malformed Authorization header.

403 Forbidden

  • API key is disabled, revoked, or outside allowed scope.
  • Organization IP allowlist blocks the caller source IP.
  • Key belongs to a different environment or organization.