How to authenticate with API keys
Include your API key in theAuthorization header on every request:
API key scopes and permissions
API keys use scope-based access control. All scopes are enabled by default:
You can restrict scopes when creating an API key to limit access.
Rate limits and usage quotas
The API enforces hourly rate limits and monthly usage quotas per API key. Your current limits and usage are visible in your API key settings.Rate limit headers
Every response includes headers so you can track usage proactively:
Which pair of monthly headers you receive depends on your plan, so read whichever one is present.
X-Monthly-Reset also describes a different window in each case: the end of the calendar month on a capped plan, the end of your billing period on a metered one.
When either limit is exceeded, the API returns 429 Too Many Requests with a Retry-After header. The two are different problem types: rate limit exceeded for the hourly limit and monthly limit exceeded for the monthly one. See error handling for how to handle them.
What counts toward your quota
Every request that authenticates successfully counts toward your monthly quota, regardless of the response status. This includes404s, validation errors, and other 4xx or 5xx responses. Two kinds of requests are not counted:
- Requests rejected at authentication: a missing or invalid API key, a blocked IP, or a plan without API access.
304 Not Modifiedresponses from conditional requests.