API keys
All Prefetch API endpoints (except /health and /ready) require an API key. Pass your key in the X-API-Key request header:
Get your API key from the dashboard.
Key validation
Every request validates your API key against the following checks, in order:
- Present — key must be included in the header
- Not revoked — key has not been manually revoked
- Not expired — key has not passed its expiry date
- Within credit limit — key has not exceeded its configured credit limit
A missing X-API-Key header returns 401 Unauthorized. All other failures (invalid, revoked, expired, or over-limit key) return 403 Forbidden.
Never expose your API key in client-side JavaScript. Proxy requests through your own backend instead.
Key security best practices
- Rotate keys regularly from the dashboard
- Use separate keys for development and production
- Set a credit limit on each key to prevent unexpected overages
- Revoke compromised keys immediately from the dashboard
Error responses
