Authentication
One bearer header. Create, name and revoke keys from the dashboard.
Every request carries an API key in the Authorization header:
curl "https://api.instadata.dev/v1/me" \
-H "Authorization: Bearer ik_live_..."Keys start with ik_live_ and are shown once at creation. Store them in a secrets manager, not in source control. Hold as many keys as you need, one per environment or service; revoking one takes effect within seconds.
Checking who you are
GET /v1/me returns the account attached to the key, which is useful in CI to confirm a secret is wired correctly. The response carries the plan, the remaining credits and the request rate.
Failure modes
| Status | Code | Meaning |
|---|---|---|
| 401 | missing_api_key | No Authorization: Bearer header |
| 401 | invalid_api_key | The key is unknown, malformed or revoked |
| 402 | out_of_credits | The balance does not cover the smallest non-empty result |
| 402 | plan_required | A free key was refused by an endpoint’s per-call minimum; a plan is the fix, not a smaller limit |
A 401 names the expected prefix in its message. A 402 carries a hint with the billing page.
Agents
The MCP server supports OAuth 2.1 with PKCE, so clients such as Claude and ChatGPT sign in with the account instead of a key. Clients that only take headers can use a key the same way: MCP server.