How to authenticate with API keys
Include your API key in theAuthorization header on every request:
API key scopes and permissions
API keys use scope-based access control. All scopes are enabled by default:
You can restrict scopes when creating an API key to limit access.
Rate limits and usage quotas
The API enforces hourly rate limits and monthly usage quotas per API key. Your current limits and usage are visible in your API key settings.Rate limit headers
Every response includes headers so you can track usage proactively:
When either limit is exceeded, the API returns
429 Too Many Requests with a Retry-After header. See error handling for details on handling 429 responses.
What counts toward your quota
Every request that authenticates successfully counts toward your monthly quota, regardless of the response status. This includes404s, validation errors, and other 4xx or 5xx responses. Two kinds of requests are not counted:
- Requests rejected at authentication — a missing or invalid API key, a blocked IP, or a plan without API access.
304 Not Modifiedresponses from conditional requests.