Authentication

Every request needs a key, except the health check. Keys are free.

Getting a key

Sign in with an email code or GitHub, then create a key on your profile. The full key is shown once, when you create it. You can hold up to 5 active keys and revoke any of them there; a revoked key stops working right away.

Sending your key

Put it in the X-API-Key header:

curl "https://api.manifestcards.app/v1/sets?lang=en" \
  -H "X-API-Key: $MANIFEST_KEY"

A missing, unknown or revoked key gets 401 unauthorized. Keep keys on your server: anyone holding one can spend its quota. Manifest stores only a SHA-256 hash of each key, so a lost key can't be recovered, only replaced.

Rate limits

Each key gets 60 requests a minute and 10,000 a day. Every response says where you stand:

• X-RateLimit-Limit: requests allowed per minute.
• X-RateLimit-Remaining: requests left in whichever window is closer to running out.
• X-RateLimit-Reset: seconds until that window resets.

Past the limit, the API answers 429 rate_limited with a Retry-After header, in seconds. Usage is counted per key per day, and each key belongs to the account that created it.