Skip to main content
Every request authenticates with a single header over HTTPS:
A key is bound to one firm; tenant isolation is enforced on every call. Keys are shown once at issue and stored only as salted hashes: keep yours somewhere safe.

​
Getting a key

  • Your firm key is issued by ScripX. Write to amin@eximfiles.io for a sandbox key to build against, and again when you are ready for production.
  • Child keys you mint yourself with POST /v1/keys: one per sub-account or app, each carrying a subset of your scopes. Revoke any of them at any time without touching the parent.
  • Sandbox keys carry the scripx_test_ prefix and are unmetered. See Environments.
Keep API keys server side. Never ship a key in a mobile app, a browser bundle, or a public repo. If a key leaks, revoke it and re-issue; the old hash stops matching immediately.

​
Scopes

Each key carries scopes; each endpoint demands one. A child key’s scopes are always a subset of its parent’s.

​
Authentication errors

The body is the standard flat error shape. Read the stable slug as code ?? error and branch on that, never on message; the X-Request-ID response header correlates any failure to its server-side log. See Errors.

​
Rate limits

Every key carries a monthly call quota and a per-minute rate. Sandbox keys are unmetered. Every response tells you exactly where you stand: Back off on Retry-After instead of guessing; the window is sliding, so hammering resets nothing.
  • Errors, the full error contract.
  • Keys, self-serve child keys.
  • Usage, the same numbers as JSON.