Create API Key

POST

/keys

request.sh

curl -X POST https://api.astroway.info/v1/keys \
  -H "X-Api-Key: aw_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "name": "My App", "mode": "live", "allowed_endpoints": [ "chart", "embed/*" ], "credits_cap_cycle": 20000 }'

▸ Try it POST /keys

• Production

Create a new API key. Requires an internal or enterprise API key. Returns the generated key string: save it, it cannot be retrieved later. The plan comes from the account and is not accepted in the body. allowed_endpoints limits the key to a subset of the API: paths under /v1, exact (“chart”) or a namespace (“embed/*”); omit it and the key may call everything the plan includes. credits_cap_cycle caps what this key may spend per billing cycle (0 parks it). A publishable key (origin_restriction.type “public”, prefix pk_) is for page source, so it needs allowed_origins, credits_cap_cycle and allowed_endpoints: without any of them the request is refused with 400, and a pk_ key missing a bound is refused with 403 PUBLISHABLE_KEY_UNBOUNDED wherever it is used.

Authorizations

• ApiKeyAuth

Parameters

Query Parameters

fields

string

Comma-separated dotted paths, relative to data, to keep in the response. A path is applied to every element of an array, so planets.name means the name of each planet. Paths that match nothing come back in _fields_unmatched; a list where nothing matches at all is a 400, because an empty object would be a confident wrong answer.

Example

planets.name,planets.longitude

precision

integer

<= 15

Round every non-integer number in the response to this many decimal places. Integers are left alone, because an id is not a measurement. Ecliptic longitudes ship with fourteen decimals by default; 2 is about a tenth of an arcminute.

Example

4

Request Body ^required

Media type application/json

object

name required

string

>= 1 characters <= 100 characters

mode

string

Allowed values: live test

origin_restriction

Server-only (default): a backend key that refuses any request carrying Origin or Referer. public: a publishable pk_ key for page source; needs allowed_origins, credits_cap_cycle and allowed_endpoints, and refuses a request with no verifiable origin.

object

type

string

default: server-only

Allowed values: server-only public

allowed_origins

Array<string>

<= 20 items

allowed_endpoints

Paths under /v1 this key may call, exact (chart) or a namespace (embed/*). Omitted means no limit; required for a publishable key.

Array<string>

<= 30 items

credits_cap_cycle

Credits this key may spend per billing cycle; 0 parks it. Omitted means no per-key cap; required for a publishable key.

integer

<= 1000000000

Example

{
  "name": "My App",
  "mode": "live",
  "allowed_endpoints": [
    "chart",
    "embed/*"
  ],
  "credits_cap_cycle": 20000
}

Responses

200

Successful calculation

Media type application/json

object

ok

boolean

data

object

id

number

nullable

api_key

string

nullable

api_key_masked

string

nullable

name

string

nullable

plan

string

nullable

rate_limit

number

nullable

credits_limit

number

nullable

credits_used

number

nullable

created_at

string

nullable

last_used_at

nullable

is_active

boolean

nullable

origin_restriction

object

type

string

nullable

credits_cap_cycle

number

nullable

allowed_endpoints

Array<string>

nullable

Example

{
  "ok": true,
  "data": {
    "id": 42,
    "api_key": "aw_free_a1b2c3d4e5f6a1b2c3d4e5f6",
    "api_key_masked": "aw_free…e5f6",
    "name": "My App",
    "plan": "free",
    "rate_limit": 10,
    "credits_limit": 10000,
    "credits_used": 0,
    "created_at": "2026-08-22T21:05:14.335Z",
    "last_used_at": null,
    "is_active": true,
    "origin_restriction": {
      "type": "server-only"
    },
    "credits_cap_cycle": 20000,
    "allowed_endpoints": [
      "chart",
      "embed/*"
    ]
  }
}

400

Validation error

Media type application/json

Example

{
  "ok": false,
  "error": {
    "code": "INVALID_INPUT",
    "message": "Validation failed: date: Date must be YYYY-MM-DD",
    "details": [
      {
        "path": "date",
        "message": "Date must be YYYY-MM-DD"
      }
    ]
  }
}

401

Missing or invalid API key

Media type application/json

Example

{
  "ok": false,
  "error": {
    "code": "INVALID_API_KEY",
    "message": "Invalid API key"
  }
}