Skip to main content
Every request to the eBRC API authenticates with a single header over HTTPS:
The key also selects the mode. Every request goes to the same base URL; a dev_… key runs it in test mode and a prod_… key files for real. Because the prefix is what the API reads, a mode header sent alongside a key is ignored: a test key cannot be talked into acting live.

​
Getting a key

  • Test and live keys are issued as a pair, shown once at issue, and never stored in a readable form: keep yours somewhere safe.
  • Create your account in the eBRC API console and request access there; issued keys appear in the console, where you can view and copy them.
  • Live (prod_) keys work after the Master Platform Agreement — covering production access and mutual confidentiality — is e-signed in the console.
  • You can hold several active keys of each type, so a key can be rotated without downtime. Revoke the old one when the new one is live.
  • Help, or a key reissue: amin@eximfiles.io.
Keep API keys server side. Never embed them in client-side code or commit them to version control.

​
Authentication errors

These are the exact responses the API returns: The error body follows the standard error shape.

​
Rate limits

Limits are applied per API key (per client IP when unauthenticated) over a 60 second window: When a limit is exceeded the API returns 429 with the message Too many requests. Please try again later. The API does not currently send rate limit headers, so back off and retry after a short delay rather than reading headers.

​
Free general use

The API is free for general use: the rate limits above, plus a published allowance of 250 live certificates a month and 10 exporter entities in either mode, with test filing not metered. The full definition and the quote path for volume live on the Pricing page.
  • Base URL and Modes explains the one base URL and how a key’s prefix selects test or live.
  • Errors documents the error body and common failures.
  • Quick Start makes your first authenticated calls.