Authentication
API keys, headers, and rate limits.
API key header
Production requests must include the API key header. Sandbox route quotes and dry-run solves are keyless — see /docs/sandbox.
X-ORKID-API-Key: <40-char-hex-key>API keys are 40-character hex strings. Only a SHA-256 hash is stored on Orkid's side, so the plaintext key is shown once when it is created.
Getting a key
Starter keys are self-serve — no call required:
- Go to orkidlabs.xyz/partner and enter your email.
- Your partner account is created and a production key is issued immediately — the plaintext key is shown once, so save it.
- The starter key is on the
freetier (60 req/min). Volume rebates on rolling 30-day windows apply automatically.
Higher tiers (pro, enterprise), custom rate limits, dedicated fee arrangements, and sandbox keys are provisioned by Orkid — contact api@orkidlabs.com or schedule a call.
Rate limits
| Environment | Tier | Requests / minute |
|---|---|---|
| Production | free | 60 |
| Production | pro | 120 |
| Production | enterprise | 1000 |
| Sandbox | anonymous | 60 per IP |
| Sandbox | pilot key | 300 |
Sandbox keys
Sandbox keys are optional — route quotes and dry-run solves work with no key at all; a sandbox key only raises the rate limit. Sandbox keys are distinct from production keys. See Sandbox environment.
Browser requests
Browser-based requests (e.g. from a frontend widget) are handled differently — the Next.js middleware issues short-lived orkid_quote_token cookies. If you're building a browser integration, use the embed generator or hosted swap pages, or contact us for a browser token.
Key security
- Never expose a production API key in client-side code, public repos, or frontend bundles.
- For browser integrations, use a partner proxy: your backend holds the key and forwards requests with the
X-ORKID-API-Keyheader. - Rotate keys immediately if compromised. Contact
api@orkidlabs.comto revoke and reissue.