Docs
API key
Every block that reads data needs a valid Poker Study API key to run live. Building blocks that never call the API, such as playing cards, are not gated. These are the rules this site follows.
One prompt, for the whole site
The site asks for the key once, in the header. Three pieces share it. A key provider, a React context, wraps the docs layout and holds the key for every page. A key-entry component in the header is the only place a visitor types it. Data previews sit inside one gated preview wrapper.
The provider saves the key in sessionStorage for that browser tab. It leaves localStorage and cookies unused, so closing the tab clears the key.
Checking the key
Before a preview goes live, the site checks the key with GET https://www.pokerstudy.ai/api/trainer/stats and an Authorization: Bearer psk_… header. That call is the light check: it accepts a Studio personal access token, the same rule as the rest of the API, and answers with a small summary of that account's preflop drills. Mint the key on API settings. The docs site reads the status code and discards the body.
200: the key is valid. Previews may call the API.401: the key is missing, revoked, or not a Studio key. Previews stay on the sample.503: the check could not run. Keep the sample up and try again.
The key is only sent to pokerstudy.ai, in the Authorization header. It is never logged. It is cleared when the tab closes.
What a preview shows with no key
With no valid key, the wrapper shows a static or sample state of the component and a button labelled Enter your API key. That sample and that button are the whole preview.
In an app you ship
The docs site is the place a browser holds a key, and only for the tab, and only to call pokerstudy.ai. In your own app the key stays on the server. Installing a data block adds app/api/pokerstudy/[...path]/route.ts, the API proxy. Set POKERSTUDY_API_KEY in the server environment. The browser calls your proxy, and the proxy adds the key. Keep the psk_ key out of client code.