02 Guides
API key and headers
One key per client, in one header. The key works from any country and any server.
The key in a header
Every data request sends the key in the X-API-Key header. We keep only a hash of the key; a lost key is rotated in the bot — the old one works for 24 more hours and the quota is not reset.
curl -s "https://api.apiauto.space/v1/usage" \
-H "X-API-Key: $APIAUTO_KEY"Without a key or with a wrong one the answer is 401 unauthorized; every code is in API error codes.
The key stays on the server
The API does not allow browser requests (CORS is off): a key in page code would be visible to every visitor. A site or a bot calls the API from its own server and shows clients its own pages.
Response headers
| Response header | Meaning |
|---|---|
X-Quota-Limit | The period quota: cars a month (requests a day on the demo). |
X-Quota-Remaining | How much is left. |
X-Quota-Reset | When the quota renews, ISO 8601 UTC. |
X-RateLimit-Limit | Requests per second on the plan. |
X-RateLimit-Remaining | Left in the current second. |
X-RateLimit-Reset | Seconds until the counter resets (1). |
Retry-After | On 429 and some 503s: seconds to wait before retrying. |
X-Data-Age-Seconds | The age of the market copy in seconds. |
How to get a key
- Open the bot@apiautospace_bot in Telegram and press Start.
- Take the demoOne day, 100 requests, all three markets and the change feed — no card.
- Save the keyThe key comes in a message of its own and is shown once.