Documentation

API in your tools

Import the specification or ready-to-use request folders. Postman creates collection variables automatically; fill in the server address and your keys locally.

OpenAPI 3.1 · JSON · Postman collection · Postman environment

API keys and access rights

An API key belongs to its creator and one workspace. Switching workspaces in the browser does not change the scope of an existing key.

Create a key

In Tokens → API keys, select Create API key and choose its purpose, expiry, and whether it can write data. You need permission to manage tokens. New keys are read-only by default. Expiry can range from one day to one year.

A write-enabled key can perform only actions its owner is allowed to perform. It does not increase their role or open another person's sites. Even a platform operator's key remains bound to the selected workspace.

Changes to access

Every request checks expiry, revocation, the user's active status, workspace membership, current role, and access to the specific site. If the workspace requires two-factor authentication, the owner must configure it in their profile. Removing a team member also disables their key's access.

The key list shows its name, prefix, expiry, last use, and status. The secret is not stored in plain text and cannot be displayed again. To rotate a key, create a replacement, update your integration, then revoke the old one. Revocation cannot be undone.

External API boundaries

The external API covers data collection and delivery resources. It does not expose the AI assistant, creation of new API keys, user and role administration, payments, agent deployment, agent secrets, or internal synchronization. Agents are available for reading only.

Do not send your key to a store visitor's browser. Make requests from your own server. Never write the Authorization header to public logs.

Rate and cost

Each key allows up to 120 API requests per minute. Some heavier operations also have a shared limit. Respect Retry-After when the server returns 429. API request limits differ from a site's RPS: the latter controls requests the collector sends to the source.

Creating and running resources, processing, and downloads consume the workspace's ordinary limits. A key does not provide a separate free allowance. See limits.

Identifier format and security

A UUID or short link does not grant additional permissions. User, workspace, and site checks are the same for legacy numbers, UUIDs, and short forms. V2 uses the same keys and permissions as v1. Identifier compatibility.