Skip to main content

​
API key authentication

API-key endpoints accept either header. Both carry the same raw API key; choose one convention per integration.
Keys generated in the dashboard begin with astrom8_ followed by a random value. The prefix does not indicate a live, test, or internal key type. Treat keys as secrets, keep them in server-side environment variables, use separately named keys for each environment, and rotate a key immediately if it may have been exposed.

​
Customer session authentication

Customer delivery and report-management routes use an astrom8_sess_* bearer token returned by the customer authentication flow, not an API key. The reference marks those operations with SessionBearerAuth; do not send a customer session token to API-key endpoints.

​
Tiers and credits

The reference declares requirements per endpoint. Some calculations are available synchronously; premium interpretation and PDF workflows may require a higher tier or debit credits after the request is accepted. Use POST /api/v3/estimates to inspect eligibility and the estimated debit before submitting a billable capability. The actual endpoint remains authoritative: it checks tier, balance, idempotency, and debit atomically.

​
Common responses

See rate limits and errors for retry and idempotency guidance.