Authentication

Keys & auth

Every request needs Authorization: Bearer cl_live_…. Keys are created per org in dashboard Settings and can be revoked at any time. Invalid or missing keys get a generic 401 — no detail about which check failed.

Rate limits: 60 requests/min on Pro (the standard tier), 300 on Studio (elevated). Exceeding your limit returns 429 with a Retry-After header. API access isn't included on the free plan — see pricing.

Error envelope

Every error is { "error": { "code", "message" } }. Codes:

unauthorized
not_found
validation_failed
rate_limited
quota_exceeded
budget_exceeded
entitlement_required
role_required
upstream_unavailable
internal