API keys in self-service

The API keys page (/en/account/api-keys) — for the owner only. A member calling it directly gets “forbidden”.

The rules

Rule	Value
Count per plan	Free 1, Startup 0, Team 0, Business 5, Enterprise unlimited
Monthly limit per key	from the plan: Free 10, Business 2,500
Plaintext	shown exactly once, immediately after creation
Stored	only the SHA-256 hash
Name	unique per tenant
Block / unblock / delete	effective at once, without a restart

The plaintext appears exactly once

Only a hash is stored. A lost key is replaced, not recovered — so put it straight where your application reads it from.

The quota belongs to the tenant, not to the key

The table names each key’s limit, and the consumption appears once below it: “Used this month: x of y calls.” So a second key does not double the quota — it merely separates the access paths, for two applications, say.

Startup and Team have no API access at all

This is easy to overlook

Both plans are set to zero keys. The page then does not report “at most 0 keys” but points to the Business plan. Anyone wanting to build an integration needs Business or an Enterprise installation.

Free has exactly one key with ten calls a month — for trying out, not for running.

Where the technical details live

Headers, error responses, rate limiting and the question of which call consumes which quota are described in the REST documentation of the product repository. The interactive reference sits on the running service at /api-docs.

The plan limits at a glance are under Plan, quotas and the format gate.