Skip to main content

API Keys

All API requests require authentication using an API key. Include your key in the x-api-key header with every request.

Key Format

Use the complete key issued by your dashboard or integration. Treat it as an opaque secret: do not enforce a fixed length or reconstruct it from an example.
Keep your API key secret! Never expose it in client-side code or public repositories.

Request Headers

Error Responses

Missing API Key

Status Code: 401 Unauthorized

Invalid API Key

Status Code: 401 Unauthorized

Code Examples

Rate Limits

The API allows 1,000 requests per second per authenticated client. All direct API keys belonging to the same organization share one budget across API instances. Changing keys within that organization, connections or IP addresses does not create another allowance. Legacy keys without an organization use their own key budget; marketplace requests use the authenticated provider account. The API applies this limit after authentication. If you reach it, you receive 429 with error: "rate_limit_exceeded" and Retry-After: 1. Rejected requests do not extend the one-second window. If the shared request counter is unavailable, the API returns 503. For multiple downloads, use POST /jobs/bulk: up to 100 jobs in one request, with shared encoding options and a direct API key. Storage allowances, account quotas and server capacity checks still apply. See Rate limits for the response format.
Contact us if you need higher limits for your use case.

Security Best Practices

Store your API key in environment variables, not in code:
Always make API calls from your backend server, never from client-side JavaScript.
If you suspect your key is compromised, contact us immediately for a new key.