Skip to main content
Most catalog GET routes under /api/v1 can be called without an API key. Requests that create, list, or delete your configs — or read project-owned analytics — still require donate-api-key so we know the caller.

​
When you need a key

Include your API key with the donate-api-key header when you have one:
Anonymous public reads (no header) use a stricter IP-based rate limit intended for light catalog browsing. See Rate Limits.
Never expose your API key in client-side code, public repositories, or anywhere it could be accessed by others. Browser apps should call public GET routes without a key, or proxy keyed calls through your server.

​
Error responses

If authentication fails on a route that requires a key, the API returns one of the following errors: Example error response:

​
Spec endpoints

The following endpoints do not require the donate-api-key header and are not rate-limited:

​
Keeping your key secure

  • Store your API key in environment variables, never hardcoded
  • Do not commit it to version control
  • If your key is compromised, contact us at support@donate.gg to have it rotated

Don't have an API key yet?

Apply for API access