Skip to main content
Every request carries an API key in a header. There are no unauthenticated endpoints.
1

Get a key

Sign in to the dashboard and create a key. It is shown once, so store it somewhere durable at that moment.
2

Send it as a header

Use x-api-key, or Authorization: Bearer if that suits your client better. Both are accepted and equivalent.
3

Confirm it works

/coverage is the cheapest authenticated call. A 200 means the key is live; a 401 means it is missing, malformed or revoked.
Never put the key in a query string. It is refused there deliberately, because query strings end up in server logs, proxies and browser history.

​
What a key can read

Access is governed by two independent things: Your plan decides rate limits and how much history you can reach. The free tier is limited to recent history; paid tiers reach the full archive. The rights on each feed decide whether the data can be served to you at all. A minority of sources are licensed to us in ways that do not permit redistribution. Those rows return no value regardless of plan, and say why rather than failing silently. See Sources and rights.

​
Errors

Every error carries a stable code and a request_id. Quote the request_id when reporting a problem; it identifies the exact request in our logs.
Unknown query parameters are rejected with a 400 naming the key, rather than ignored. A typo fails loudly instead of silently returning unfiltered data.