Authentication
The API is authenticated with keys. A key belongs to one account and can be revoked at any time. The daily allowance belongs to the account, not the key.
Creating a key
Sign in and create a key on your dashboard. Keys start with rd_.
The full key is shown once. Only a hash of it is stored, so it cannot be shown again — if you lose it, revoke it and create another. The dashboard lists the first few characters so you can tell your keys apart.
Sending a key
Send it as a bearer token in the Authorization header:
curl 'https://api.tinyplates.dev/recipes?limit=3' \
-H 'Authorization: Bearer rd_your_api_key'That is the only header the API documents. The key goes in a header and never in the query string, so it stays out of logs, browser history and shared links.
Optional, for now
Requests without a key are accepted today. That will change, and the change will be announced before it happens. Send a key from the start and nothing breaks when it does.
A key that is sent is always checked, even now. An invalid, revoked, expired or rate-limited key is refused whether or not keys are required.
When a key is refused
- 401
An API key is required. Pass it as an Authorization: Bearer header.
No key was sent, and this deployment requires one. Keys are optional today and will become required.
- 401
Invalid API key.
The key does not exist. Check for a truncated copy, or create a new one on your dashboard.
- 401
This API key has been disabled.
The key was revoked. Create a new one on your dashboard.
- 401
This API key has expired.
The key was created with an expiry that has passed. Create a new one.
- 429
Rate limit exceeded for this API key. Try again later.
The account has used its 500 requests for the day. The allowance is per account, so another key will not help. It resets at midnight UTC.
Looking after a key
- Keep keys server-side. Anything in a browser bundle or a mobile app is public, and a key there is a key anyone can spend.
- Use a key per application, so revoking one does not take the others down with it, and so the usage chart tells you which is which.
- Revoking is immediate. The next request with that key is refused.
Usage is counted per key per day and shown on your dashboard, but the daily allowance is spent by the account as a whole. See rate limits for what happens at the ceiling.