Skip to main content

Authentication

All Inherent API requests require authentication using an API key.

Creating an API Key​

  1. Log in to the Inherent Dashboard
  2. Navigate to Settings > API Keys
  3. Click Create API Key
  4. Give it a descriptive name (e.g., "Production Backend")
  5. Copy the key immediately - you won't see it again!

Using Your API Key​

Include your API key in the X-API-Key header:

curl -X GET https://api.inherent.sh/v1/documents \
  -H "X-API-Key: ink_your_api_key"

API Key Format​

Every API key is prefixed with ink_ followed by a random token — for example, ink_abc123.... The full key is shown only once, at creation time.

Create a separate key for each environment and application rather than reusing one key everywhere. Keys are scoped to a single workspace and to specific permissions.

Security Best Practices​

Do​

  • Store API keys in environment variables
  • Use different keys for different environments
  • Rotate keys periodically
  • Use the minimum required permissions

Don't​

  • Commit API keys to version control
  • Share keys between team members
  • Use production keys in development
  • Log API keys in application logs

Rate Limits & Quotas​

Inherent has a single plan, so quotas are the same for everyone:

PlanStorageAPI calls / monthFair-use rate limit
Pro (incl. 14-day free trial)30 GBUnlimited60 requests/min (20/min for chat)

The 14-day free trial gets full Pro access at these same limits. Requests are also subject to the fair-use per-minute limit above. When you exceed it, you'll receive a 429 Too Many Requests response:

{
  "type": "https://api.inherent.sh/errors/rate-limit-exceeded",
  "title": "Rate Limit Exceeded",
  "status": 429,
  "detail": "Rate limit exceeded. Retry after 60 seconds.",
  "instance": "/v1/documents",
  "trace_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "timestamp": "2026-04-03T12:34:56.789Z"
}

Revoking API Keys​

To revoke a compromised key:

  1. Go to Settings > API Keys
  2. Find the key to revoke
  3. Click the Revoke button
  4. Confirm revocation

Revoked keys immediately stop working. Make sure to update your application with a new key first.