Authentication

All Inherent API requests require authentication using an API key.

Creating an API Key

1. Log in to the Inherent Dashboard
2. Navigate to Settings > API Keys
3. Click Create API Key
4. Give it a descriptive name (e.g., "Production Backend")
5. Copy the key immediately - you won't see it again!

Using Your API Key

Include your API key in the X-API-Key header:

curl -X GET https://api.inherent.sh/v1/documents \
  -H "X-API-Key: ink_your_api_key"

API Key Format

Every API key is prefixed with ink_ followed by a random token — for example, ink_abc123.... The full key is shown only once, at creation time.

Create a separate key for each environment and application rather than reusing one key everywhere. Keys are scoped to a single workspace and to specific permissions.

Security Best Practices

Do

• Store API keys in environment variables
• Use different keys for different environments
• Rotate keys periodically
• Use the minimum required permissions

Don't

• Commit API keys to version control
• Share keys between team members
• Use production keys in development
• Log API keys in application logs

Rate Limits & Quotas

Each plan includes a monthly API-call quota:

Plan	API calls / month
Free	1,000
Pro	50,000
Enterprise	200,000

Requests are also subject to a short-term burst limit at the edge. When you exceed a limit, you'll receive a 429 Too Many Requests response:

{
  "type": "https://api.inherent.sh/errors/rate-limit-exceeded",
  "title": "Rate Limit Exceeded",
  "status": 429,
  "detail": "Rate limit exceeded. Retry after 60 seconds.",
  "instance": "/v1/documents",
  "trace_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "timestamp": "2026-04-03T12:34:56.789Z"
}

Revoking API Keys

To revoke a compromised key:

1. Go to Settings > API Keys
2. Find the key to revoke
3. Click the Revoke button
4. Confirm revocation

Revoked keys immediately stop working. Make sure to update your application with a new key first.