API Keys

API keys authenticate your requests to the API. You manage them entirely from the dashboard: set a category, restrict usage with rolling quotas, add an expiry date, and monitor activity per key through request logs.

For how to include a key in a request, see the Introduction.

Creating a key

Key fields

Categories

Categories tag keys for your own organization. They appear in dashboard filters and analytics but do not change how the API processes a request.

Keep one key per environment so you can revoke or rotate it independently.

Per-key quotas

Each key can have independent hard caps on request volume, enforced on rolling windows (not calendar boundaries):

Leave a field blank to apply no cap for that window. When a quota is reached, the API returns 401 Rate Limit Exceeded with the quota name in the message:

{ "error": "Rate limit exceeded: quota total" }

{ "error": "Rate limit exceeded: quota daily" }

{ "error": "Rate limit exceeded: quota weekly" }

{ "error": "Rate limit exceeded: quota monthly" }

Per-key quotas are distinct from plan-level rate limits (per-second and per-minute caps that apply account-wide). Plan limits return 429 Too Many Requests. See Error Handling for details.

Expiry

Set an expiry date on keys used in scripts, CI pipelines, or partner integrations. Once the date passes, the API returns:

{ "error": "Expired API Key" }

HTTP status 401. Create and deploy a replacement key before the expiry date to avoid any downtime.

Request logs

Every request made with a key is recorded under API Keys → Logs in the dashboard. Each entry shows:

Use logs to audit activity per key, debug unexpected errors, or identify traffic from compromised keys.

Deactivating vs. deleting

Prefer deactivation over deletion. If a key has request history, it cannot be deleted. The history is retained for billing and auditing.

Rotating a key

Error reference

See also: Best Practices for security guidelines and Glossary for term definitions.