API reference / Basics

Authentication

API keys, how to send them, and how they are metered.

Mint a key in the console under Settings → API keys. The key is shown once, at creation — only a hash is stored, so copy it then.

Every requestbash

curl https://app.prepaid.ai/api/v1/balance \
  -H "Authorization: Bearer pk_live_your_key_here"

What a key can reach#

A key is scoped to one workspace, and that scope is the only tenant identity the API has. No parameter, header or body field can name a workspace — anything you send is ignored in favour of the key’s own.

Rate limiting#

Failed authentication is metered by source, so a scan costs the scanner rather than you.
Successful calls are metered per key.
A 429 carries a Retry-After header saying how long to wait.

Worth knowingRevoke a key the moment it is exposed. Because only a hash is stored, a lost key cannot be recovered or re-shown — mint a new one.

Errors and conventions →