Skip to main content
OrbiSearch authenticates every request using an API key that you pass in the X-API-Key HTTP header. There are no OAuth flows or session tokens. Just include your key on every request.

​
Get your API key

  1. Sign in to your OrbiSearch account.
  2. Go to Dashboard → API.
  3. Create a new key and copy it immediately, as it will not be shown again.

​
Key types

There are two API key types, created on the same dashboard page:
  • Pay as you go keys authenticate the credit-metered /v1 endpoints. This is the default key type.
  • Unlimited keys require an active unlimited plan and authenticate the /v1/unlimited endpoints.
Each key type works only on its own endpoint family. Using a pay-as-you-go key on /v1/unlimited/*, or an unlimited key on a credit-metered /v1 endpoint, returns 403 with code: wrong_key_plan. The one exception is POST /v1/content-spam-check, which accepts both key types.
Keep your API key secret. Do not include it in client-side code, public repositories, or anywhere that could expose it to unauthorized users. If a key is compromised, revoke it from the dashboard and create a new one.

​
Pass your key in requests

Include your API key in the X-API-Key header on every request:
Replace YOUR_API_KEY with your actual key.

​
Authentication errors

If your key is missing or invalid, the API returns a 401 Unauthorized response:
Check that:
  • The X-API-Key header is present on every request
  • The key value is correct and has not been revoked
  • There are no leading or trailing spaces in the key value

​
Rate limits

Each account is rate-limited to 20 requests per second, shared across all of its API keys. If you exceed this limit, the API returns a 429 Too Many Requests response. Contact OrbiSearch if you need higher throughput. On unlimited plans, single searches are additionally limited to your plan’s per-account requests-per-second rate; see unlimited plans. Every authenticated response includes X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers describing your account’s current window, so clients can self-throttle instead of hitting 429s. See errors for how to handle rate-limit responses.