Authentication & quota

Web workspace access and API keys are separate credentials with separate allowances.

Supported headers

HTTP headers

Authorization: Bearer YOUR_API_KEY

# Alternatively, use this header on its own:
X-API-Token: YOUR_API_KEY

Use the exact Bearer prefix, including the space. Send one supported credential header; do not put the key in a URL or in source code.

Default allowances

Web workspace

Allowance: 3 successful builds per 24-hour window, starting with your first build.
Cooldown: 60 seconds after success; 30 seconds after a code error.

Web-issued API key

Allowance: 5 successful requests per reset period; 24 hours by default.
Cooldown: 90 seconds after success; 30 seconds after a code error.

Configured access

Allowance: Managed workspace access and administrator-issued API keys can have their own limits.
Cooldown: Use the policy shown for the credential.

Credential	Allowance	Cooldown
Web workspace	3 successful builds per 24-hour window, starting with your first build.	60 seconds after success; 30 seconds after a code error.
Web-issued API key	5 successful requests per reset period; 24 hours by default.	90 seconds after success; 30 seconds after a code error.
Configured access	Managed workspace access and administrator-issued API keys can have their own limits.	Use the policy shown for the credential.

Reading usage

Successful API responses return credits, limit, cooldownRemaining, resetAt. Credits is the remaining API allowance; cooldownRemaining is in milliseconds. API usage does not consume the default web workspace allowance.

When access fails

Missing, invalid, revoked or inactive API credentials return HTTP 404 with status: false. Exhausted API credits return HTTP 401; an active cooldown returns HTTP 429.

Do not repeatedly retry authentication or quota errors. Check the key, its usage and reset time in API access.