Skip to main content
OrbiSearch authenticates every request using an API key that you pass in the X-API-Key HTTP header. There are no OAuth flows or session tokens — just include your key on every request.

​
Get your API key

  1. Sign in to your OrbiSearch account.
  2. Go to Dashboard → API.
  3. Create a new key and copy it immediately — it will not be shown again.
Keep your API key secret. Do not include it in client-side code, public repositories, or anywhere that could expose it to unauthorized users. If a key is compromised, revoke it from the dashboard and create a new one.

​
Pass your key in requests

Include your API key in the X-API-Key header on every request:
Replace YOUR_API_KEY with your actual key.

​
Authentication errors

If your key is missing or invalid, the API returns a 401 Unauthorized response:
Check that:
  • The X-API-Key header is present on every request
  • The key value is correct and has not been revoked
  • There are no leading or trailing spaces in the key value

​
Rate limits

Each API key is rate-limited to 20 requests per second. If you exceed this limit, the API returns a 429 Too Many Requests response. Contact OrbiSearch if you need higher throughput. Every authenticated response includes X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers describing your current per-key window, so clients can self-throttle instead of hitting 429s. See errors for how to handle rate-limit responses.