API Key Management

Create a new API key

Creates a new API key for accessing the API. RateAPI—not the client—generates the credential. Supply a fresh, cryptographically random UUIDv4 in the optional Idempotency-Key header so a byte-identical retry can replay the same encrypted response for up to 24 hours without minting a second key. Callers that omit the header retain the legacy one-time response behavior and cannot recover a lost response. Store the returned credential securely; after the recovery window it cannot be retrieved.

New keys are created at Tier 1 (Free) with 20 requests per 30 days. An email address is required in the request body. Link your key to an organization for plan-level shared limits.

Rate limit: 1 key per IP address per 30 days to prevent abuse.

post/keys

Request

  • Base URL: https://api.rateapi.dev
  • URL: https://api.rateapi.dev/keys
  • Auth: none required

Headers

Idempotency-Keystring uuid

Optional but strongly recommended: a fresh, cryptographically random UUIDv4 identifying this enrollment request. It cannot authorize normal RateAPI calls, but for 24 hours it is a sensitive recovery capability that can replay the returned API key when paired with the identical request body. Never log or share it. Persist it only until the returned credential is safely stored, and reuse it only with the byte-identical request body after an ambiguous timeout. Omitting the header preserves the legacy one-time response behavior but makes a lost response unrecoverable.

Request body

emailstring email required

Required email address for account recovery and important API updates. Does not affect rate limits.

sourcestring

Optional bounded signup-surface attribution, such as npm-cli.

referrerstring

Optional bounded signup referrer attribution. Never used for authorization.

Example request

{
  "email": "developer@example.com",
  "source": "npm-cli",
  "referrer": "https://rateapi.dev/agents"
}

Response

API key created successfully

idstring required

Unique identifier for the API key. Use this ID for /keys/:id endpoints to check usage or disable the key.

keystring required

Server-generated API key to use in X-API-Key. A byte-identical retry with the same enrollment UUID can replay it for up to 24 hours; after that only the long-term hash remains.

messagestring required

Warning message reminding you to store the key securely

emailRegisteredboolean required

Present and true when an email was provided and validated.

Example response

{
  "id": "9f4c1ad27b83e650",
  "key": "rk_a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1a3f1",
  "message": "Store this key securely. An identical retry can recover it for up to 24 hours; after that it cannot be retrieved.",
  "tier": {
    "level": 1,
    "name": "Free",
    "limit": 100,
    "windowDays": 30
  },
  "emailRegistered": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.