API Keys
All API requests require authentication using an API key. Include your key in thex-api-key header with every request.
Key Format
Use the complete key issued by your dashboard or integration. Treat it as an opaque secret: do not enforce a fixed length or reconstruct it from an example.Request Headers
Error Responses
Missing API Key
401 Unauthorized
Invalid API Key
401 Unauthorized
Code Examples
Rate Limits
The API allows 1,000 requests per second per authenticated client. All direct API keys belonging to the same organization share one budget across API instances. Changing keys within that organization, connections or IP addresses does not create another allowance. Legacy keys without an organization use their own key budget; marketplace requests use the authenticated provider account. The API applies this limit after authentication. If you reach it, you receive429 with error: "rate_limit_exceeded" and Retry-After: 1. Rejected requests do not extend the one-second window. If the shared request counter is unavailable, the API returns 503.
For multiple downloads, use POST /jobs/bulk: up to 100 jobs in one request, with shared encoding options and a direct API key. Storage allowances, account quotas and server capacity checks still apply. See Rate limits for the response format.
Contact us if you need higher limits for your use case.
Security Best Practices
Environment Variables
Environment Variables
Store your API key in environment variables, not in code:
Server-Side Only
Server-Side Only
Always make API calls from your backend server, never from client-side JavaScript.
Key Rotation
Key Rotation
If you suspect your key is compromised, contact us immediately for a new key.