Authentication

API keys

Send your key on every data request:

X-API-Key: vk_live_xxxxxxxxxxxxxxxxxxxx

Keys are vk_live_ (production) or vk_test_. Only a SHA-256 hash is stored — your plaintext key is shown once at creation, so save it.

Admin token

Key management (/v1/admin/keys) is gated by a separate X-Admin-Token. Keep it server-side. If it's unset, the admin API is disabled entirely.

Verify a key

curl "https://api.buildwithapi.io/v1/auth/verify" -H "X-API-Key: vk_live_..."
# -> { "valid": true, "tier": "pro" }

Rate limits

Requests are rate-limited per key/IP. Limits scale with your plan. A 429 response includes a Retry-After header.