> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ebrc.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate the eBRC API with a single x-api-key header over HTTPS. Covers key issuance, contract-gated production access, and per-endpoint rate limits.

Every request to the eBRC API authenticates with a single header over HTTPS:

```bash theme={"dark"}
x-api-key: <YOUR_API_KEY>
```

## Getting a key

* Keys are issued per [environment](/environments), shown once at issue, and never stored in a readable form: keep yours somewhere safe.
* Create your account in the eBRC API console and request access there; issued keys appear in the console, where you can view and copy them.
* Production keys work after the NDA and production agreement, both e-signed in the console.
* Help, or a key reissue: [amin@eximfiles.io](mailto:amin@eximfiles.io).

<Warning>
  Keep API keys server side. Never embed them in client-side code or commit them to version control.
</Warning>

## Authentication errors

These are the exact responses the API returns:

| HTTP | `message`                                      | Why                                               |
| ---- | ---------------------------------------------- | ------------------------------------------------- |
| 401  | `No API key provided`                          | The `x-api-key` header is missing                 |
| 401  | `Invalid API key`                              | The key does not match any active key             |
| 403  | `Only platform users can access this resource` | The key is valid but not a platform key           |
| 403  | `NDA and agreement not signed yet`             | Contract signing is not complete for this account |

The error body follows the standard [error shape](/errors).

## Rate limits

Limits are applied per API key (per client IP when unauthenticated) over a 60 second window:

| Endpoint                                               | Limit per minute |
| ------------------------------------------------------ | ---------------- |
| `POST /platform-customers/{id}/check-dgft-credentials` | 4                |
| `POST /genebrc/bulk-upload`                            | 5                |
| `GET /genebrc/download-pdf/{eBRCNumber}`               | 5                |
| `POST /irm/refresh`                                    | 6                |
| `POST /genebrc/push-irm`                               | 10               |
| `POST /genebrc/fetch-details`                          | 10               |
| `GET /irm/bulk-template`                               | 10               |
| All other endpoints                                    | 100              |

When a limit is exceeded the API returns **429** with the message `Too many requests. Please try again later.` The API does not currently send rate limit headers, so back off and retry after a short delay rather than reading headers.

## Free general use

The API is free for general use: the rate limits above, plus a published allowance of 250 production certificates a month and 10 exporter entities, with sandbox not metered. The full definition and the quote path for volume live on the [Pricing](/pricing) page.

## Related

* [Environments and Base URLs](/environments) explains which host each key works against.
* [Errors](/errors) documents the error body and common failures.
* [Quick Start](/quick-start) makes your first authenticated calls.