Versioned API: /api/v1
Every v1 endpoint works without a key, on the per-minute budget of your IP address. With a key, calls draw on your account's own daily quota instead.
1. Get a key
Sign in, open your profile and create a key under API keys. The full key is shown once, when you create it: copy it then. MESSAI stores only a hash, so a lost key cannot be recovered, only replaced. Revoke a key on the same page at any time.
Open your profile 2. Send it with every call
In the X-API-Key header, or as Authorization: Bearer. A revoked, expired or mistyped key gets 401; it never falls back to anonymous access.
X-API-Key: sk_free_…
Authorization: Bearer sk_free_…
3. Watch the limits
Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds until the next request is available). Over the limit, the API answers 429 with Retry-After.
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 997
X-RateLimit-Reset: 86
Limits
| Caller | Budget | Counted per |
| API key | 1,000 requests a day, refilled continuously (one every 86.4 s) | Account: all of its keys share one quota |
| No key | 60 requests a minute, in bursts of up to 120 | IP address |
| Signed in on www.messai.io | 300 requests a minute, in bursts of up to 600 | Account |
A read counts as one request. On the website endpoints heavier calls count more: POST /api/ml/predict 10, POST /api/chat 25, any other write 2. API keys apply to /api/v1 only.
Managing keys (GET and POST /api/v1/api-keys, DELETE /api/v1/api-keys/{id}) takes a signed-in session, not an API key: these are the calls your profile page makes.