API Authentication

All requests to the Limitly API require authentication using your API key.

Authentication Method

Limitly uses Bearer Token authentication. Include your API key in the Authorization header:

curl -H "Authorization: Bearer lk_1234567890abcdef1234567890abcdef" \
     https://api.limitly.dev/functions/v1/keys

API Key Format

Limitly API keys follow this format:

Prefix: lk_
Length: 32 characters
Example: lk_1234567890abcdef1234567890abcdef

Getting Your API Key

Log in to your Limitly Dashboard
Navigate to the API Keys section
Create a new API key or copy an existing one
Use this key in your API requests

Example Requests

JavaScript (Fetch)

const response = await fetch('https://api.limitly.dev/functions/v1/keys', {
  headers: {
    'Authorization': 'Bearer lk_1234567890abcdef1234567890abcdef',
    'Content-Type': 'application/json'
  }
});

const data = await response.json();

cURL

curl -X GET \
  -H "Authorization: Bearer lk_1234567890abcdef1234567890abcdef" \
  -H "Content-Type: application/json" \
  https://api.limitly.dev/functions/v1/keys

Error Responses

If authentication fails, you’ll receive a 401 Unauthorized response:

{
  "error": "Invalid API key",
  "code": "INVALID_API_KEY"
}

Security Best Practices

Environment Variables

Store your API key in environment variables, never in your source code:

# .env
LIMITLY_API_KEY=lk_1234567890abcdef1234567890abcdef

const apiKey = process.env.LIMITLY_API_KEY;
const response = await fetch('https://api.limitly.dev/functions/v1/keys', {
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json'
  }
});

Key Rotation

Regularly rotate your API keys for enhanced security. You can regenerate keys from your dashboard without affecting your application.

HTTPS Only

Always use HTTPS when making API requests. Limitly only accepts requests over HTTPS.

Rate Limiting

The Limitly API itself is rate limited. You can make up to 1000 requests per minute per API key. If you exceed this limit, you’ll receive a 429 Too Many Requests response:

{
  "error": "Rate limit exceeded",
  "code": "RATE_LIMIT_EXCEEDED"
}

Next Steps

Request Validation - Learn how to validate user requests
API Key Management - Manage API keys for your users
Plans - Create and manage usage plans

Getting started

Node.js SDK

Next.js SDK

Python SDK

REST API

Authentication Method

API Key Format

Getting Your API Key

Example Requests

JavaScript (Fetch)

cURL

Error Responses

Security Best Practices

Environment Variables

Key Rotation

HTTPS Only

Rate Limiting

Next Steps

​Authentication Method

​API Key Format

​Getting Your API Key

​Example Requests

​JavaScript (Fetch)

​cURL

​Error Responses

​Security Best Practices

Environment Variables

Key Rotation

HTTPS Only

​Rate Limiting

​Next Steps

Authentication Method

API Key Format

Getting Your API Key

Example Requests

JavaScript (Fetch)

cURL

Error Responses

Security Best Practices

Rate Limiting

Next Steps