Authentication

The API is authenticated with keys. A key belongs to one account and can be revoked at any time. The allowances belong to the account, not the key.

Creating a key

The full key is shown once. Only a hash of it is stored, so it cannot be shown again — if you lose it, revoke it and create another. The dashboard lists the first few characters so you can tell your keys apart.

Sending a key

Send it as a bearer token in the Authorization header:

curl 'https://api.tinyplates.dev/search?query=pasta&limit=3' \
  -H 'Authorization: Bearer rd_your_api_key'

That is the only header the API documents. The key goes in a header and never in the query string, so it stays out of logs, browser history and shared links.

When a key is refused

401
An API key is required. Pass it as an Authorization: Bearer header.
No key was sent. Every endpoint except the root, /health, /docs and /openapi.json requires one.
401
Invalid API key.
The key does not exist. Check for a truncated copy, or create a new one on your dashboard.
401
This API key has been disabled.
The key was revoked. Create a new one on your dashboard.
401
This API key has expired.
The key was created with an expiry that has passed. Create a new one.
429
Daily allowance of 50 requests used. It resets at midnight UTC. Paid plans include more; see https://www.tinyplates.dev/pricing.
The account has used its 50 requests for the day. The allowance is per account, so another key will not help. It resets at midnight UTC.
429
Weekly allowance of 300 requests used. It covers the last 7 days. Paid plans include more; see https://www.tinyplates.dev/pricing.
The account has used its 300 requests over the last 7 days, today included. The allowance is per account, so another key will not help. Room comes back as older days drop out of the window.
429
Daily limit of 5,000 requests on the Personal plan reached. It resets at midnight UTC. Contact us for a higher limit.
The account has used its plan's limit for the day. The message names the number and the plan, which differ between accounts. The limit is per account, so another key will not help. It resets at midnight UTC.
429
Weekly limit of 30,000 requests on the Business plan reached. It covers the last 7 days. Contact us for a higher limit.
The account has used the weekly limit set on it over the last 7 days, today included. The message names the number and the plan. Only accounts with a weekly limit can see this. Room comes back as older days drop out of the window.

Looking after a key

Keep keys server-side. Anything in a browser bundle or a mobile app is public, and a key there is a key anyone can spend.
Use a key per application, so revoking one does not take the others down with it, and so the usage chart tells you which is which.
Revoking is immediate. The next request with that key is refused.

Usage is counted per key per day and shown on your dashboard, but the daily and weekly allowances are spent by the account as a whole. See rate limits for what happens at the ceiling.