Authentication

Jump to: Hosted · Self-Hosted (Core)

Hosted

Requests can authenticate with either an API key or a session token.

API key — send it in the X-API-Key header:

curl https://studio.underpeaks.com/api-public/v1/{project}/builder/{model} \
  -H "X-API-Key: your-api-key"

Session token — send a signed-in user's token as a Bearer token instead:

curl https://studio.underpeaks.com/api-public/v1/{project}/builder/{model} \
  -H "Authorization: Bearer your-session-token"

If both headers are present, the API key takes priority. An API key must belong to the project you're calling — using a key from a different project returns 403.

Generating a key

Generate a key from your project's Settings → API Keys.

Plan-based rate limits

Unlike Core's flat limit, hosted rate limits scale with your subscription plan. Exceeding your plan's limit returns 429 with your current plan, limit, and an upgrade link.

Self-Hosted (Core)

Every request requires an API key, sent in the X-API-Key header. Core does not support session-token authentication for the public API.

curl https://your-instance.com/api-public/v1/{project}/{table} \
  -H "X-API-Key: your-api-key"

Generating a key

Generate a key from your project's Settings → API Keys. Keys are scoped to a single project — a key generated for one project is rejected if used against another.

Revoking a key

Revoking a key marks it inactive immediately. Requests made with a revoked or unrecognized key return 401.

Rate limits

Each key is limited to 100 requests per minute, flat, regardless of plan. See Endpoints for the exact response when you exceed it.