Skip to main content
All requests require a Bearer token in the Authorization header.

Get an API key

2

Navigate to API Keys

Go to Settings → API Keys
3

Create key

Configure permissions and copy your key securely
Store your API key securely. You won’t be able to see it again after creation.

Key types

Personal Keys

Access your individual orders and resources

Organization Keys

Access organization-owned resources

Available services

The /account lookup endpoints work with any active key.

Example requests

Error responses

Invalid or missing API key.
Causes: Missing Authorization header, header not in the form Bearer <key>, unknown key, or revoked key
Insufficient permissions for the requested action.
Causes: The key does not include the service this endpoint needs
Each API key can make 60 requests per minute. Exchange and replace calls have an extra limit of 10 per minute per key.

Best practices

Keep Secret

Never expose keys in client-side code

Environment Variables

Store keys in env vars, not code

Rotate Regularly

Create new keys and revoke old ones

Least Privilege

Only enable required services

Managing keys

  • View: See your keys with their services, status, and creation date
  • Revoke: Immediately disable a key (cannot be undone)
Organization API keys scope all requests to the organization’s context—orders, billing, and resources.