All API requests (except the public catalogue) require authentication via a Bearer token.

​
API keys

Create API keys from the dashboard. Keys are prefixed with sr_live_ and are shown only once at creation.
Store your API key securely. Do not commit it to version control or expose it in client-side code.
Connecting an AI assistant rather than calling the API yourself? The MCP endpoint also lets your client sign you in, with no key to create or store.

​
Rate limits

Requests to /v1 are limited to 100 per minute, per IP address. Over that, the request is refused with 429 Too Many Requests before it reaches the API, so the response does not carry the usual JSON error body. Wait for the window to roll over and retry. The limit is per IP, not per API key: if several of your services call SocialRouter from behind the same address, they share it. Concurrency inside your own worker pool is the usual cause of hitting it. Every response states the rule in a RateLimit-Policy header ("default";q=100;w=60, RFC 9331). It is the policy, not a live remaining count: the counting happens at the edge, so the API itself never knows how much of the window you have left. When a run fails because every offer was rate-limited upstream, the 429 also carries Retry-After, in seconds.

​
Per-key credit limits

You can set optional spending limits on individual API keys. This is useful when distributing keys to team members or applications. Limits are configured per key in the dashboard with a period of hour, day, week, or month. When the limit is reached, requests return 429 with a message indicating the credit limit was exceeded.

​
Public endpoints

The following endpoints do not require authentication:
  • GET /v1/services: the service catalogue, with offers, prices and input specs
  • GET /v1/services/:platform and GET /v1/services/:platform/:service: filtered views
  • GET /v1/providers and GET /v1/providers/:id: the sources behind the offers
  • GET /v1/openapi.json: the OpenAPI 3.1 spec, one path per service