Authentication & Limits

Secure your API calls, monitor your credits, and manage rate limiting thresholds.

1.1.0API Keys

ALOC API requests must authenticate using a platform API Key. Authenticate by passing your key in the custom X-API-Key request header.

All keys are prefixed with aloc_ followed by 40 alphanumeric characters. Keep your API key confidential; do not embed it in client-side code.

X-API-Key: aloc_live_7f3a91c2d8e4f1ab92dda7b4c3e844082a1a47b8

Newly registered developer accounts are placed in a sandbox state until their email is verified.

Sandbox Limit — Capped at 100 credits total.
Requests attempting to exceed this sandbox limit will receive a 403 Forbidden response.
Verification — Verifying your email address unlocks the full 7,000 monthly credits quota on the free tier.

caution

The sandbox credit limit cannot be bypassed without email verification.

Rate limiting is enforced on a sliding 60-second window. Limits scale with your developer subscription plan:

If you exceed your rate limit, the API returns a 429 Rate Limited response with a Retry-After header indicating the seconds to wait.

Every API response returns diagnostic headers to help you track rate limits and credits in real time:

HEADERTYPEDESCRIPTION

X-RateLimit-LimitIntegerMaximum requests permitted in a 60-second window.

X-RateLimit-RemainingIntegerRemaining requests allowed within the current window.

X-RateLimit-ResetUnix TimestampEpoch time when the rate limit window resets.

X-Credits-UsedIntegerCredits consumed by this request.

X-Credits-RemainingIntegerYour remaining total account credit balance.