Skip to main content

​
API key authentication

Send your key in the X-API-Key header on every public request.
Treat keys as secrets. Keep them in server-side environment variables, use separate keys per environment, and rotate a key immediately if it may have been exposed.

​
Customer session authentication

Customer delivery and report-management routes use an astrom8_sess_* bearer token returned by the customer authentication flow, not an API key. The reference marks those operations with SessionBearerAuth; do not send a customer session token to API-key endpoints.

​
Tiers and credits

The reference declares requirements per endpoint. Some calculations are available synchronously; premium interpretation and PDF workflows may require a higher tier or debit credits after the request is accepted. Use POST /api/v3/estimates to inspect eligibility and the estimated debit before submitting a billable capability. The actual endpoint remains authoritative: it checks tier, balance, idempotency, and debit atomically.

​
Common responses

See rate limits and errors for retry and idempotency guidance.