Skip to main content

​
API keys

Send an API key with every request, except GET /v1, GET /v1/openapi.json, GET /v1/openapi.yaml and the account routes, which take a session of the web app. Make and revoke keys on the account page. A key is numi_live_ followed by 32 letters and digits. Send the key in the X-API-Key header:
Or send it as a bearer token:
GET /v1/me returns the plan of the key’s account (plan), the limits of that plan (limits) and the number of requests on the account today, this one included (requests_today). The account page shows a new key only once, because only a hash of the key is stored. If you lose a key, revoke it. Then make a new key. An account can have as many active keys at once as its plan allows.

​
Errors

Every error response has this form:
The request_id is also in the x-request-id header.

​
Rate limits

Each plan has a limit of requests a minute and a limit of requests a day, listed on the plans page. REST requests and MCP tool calls count toward the same limits, and the daily count is reset at midnight UTC. The response to a request within the limits has the RateLimit-Remaining header: the number of requests that the account has left today. The response to a request over a limit has status 429, code rate_limit_exceeded, a Retry-After header with the number of seconds to wait, and a scope field: minute for the limit a minute, day for the limit a day. The API also accepts at most 600 requests a minute from one IP address on the REST API, and 600 a minute on the MCP server, whatever keys the requests have.

​
Account routes

The /v1/account routes serve the account page of numi.sh. They take a session of the web app, not an API key.