Skip to main content
Send your key in the Authorization header on every request:
A key is tl_live_ followed by 43 characters (letters, digits, - and _). The secret is shown once, when the key is created; afterwards only its last four characters are shown.

​
Scopes

trade is reserved and refused at creation. GET /public/v1/key needs a valid key and no scope.

​
Limits on a key

  • An IP allowlist of up to 20 CIDR ranges. A request from outside it answers 403 ip_not_allowed.
  • A lifetime of at most 365 days; a key past its expires_at answers 401 unauthorized.
  • Keys per account: at most 5 active at a time.

​
Access

API access is free and granted on request: choose Request API access on the API keys page, and we enable it for your account. Every granted account is on the same free plan; GET /public/v1/key shows its limit per window_s.
  • Creating a key without granted access answers 403 access_not_granted.
  • If access is withdrawn, the account’s existing keys answer 403 access_not_granted, and its open streams close with 4403.
  • tier_required is not sent while access is granted on request.

​
Browser use

Call the API from your server. Never put a key in code that is shipped to a browser: anyone who loads the page can read it. Besides TrendlineLabs’ own web apps, the one browser origin the API answers is the documentation site, https://platform.trendlinelabs.ai, so its “try it” panel can send GET requests with the key you paste there; no cookies are sent or accepted. A browser on any other site gets no CORS headers, and its preflight answers 400.

​
Failures

  • No key, or a key that is unknown, revoked or expired: 401 unauthorized, with WWW-Authenticate: Bearer realm="public-api".
  • Too many failed authentications from one address: 429 rate_limited with Retry-After.
  • A key without the route’s scope: 403 insufficient_scope.
Revocation takes effect on every server at once.