Authentication

How to securely authenticate your requests with BlitzAPI.

Agents & LLMs: a Markdown version of this page is available by appending .md to the URL, and the full documentation index is at llms.txt.

BlitzAPI uses API Keys to authenticate requests. You can view and manage your API keys in the BlitzAPI Dashboard.

The `x-api-key` Header

Authentication to the API is handled via an HTTP header. Include your API key in every request using the x-api-key header.

Security Warning: Your API keys carry many privileges. Do not use your API keys in client-side code (browsers, mobile apps).Always route requests through your own backend server to keep your keys secret.

Example Request

Here is how to set the header in various environments:

curl "https://api.blitz-api.ai/v2/account/key-info" \
 -H "x-api-key: YOUR_API_KEY"

from blitz_api import BlitzAPI

# Pass the key explicitly, or set BLITZ_API_KEY and call BlitzAPI().
# The SDK sends it in the x-api-key header on every request.
client = BlitzAPI(api_key="YOUR_API_KEY")

import { BlitzAPI } from "blitz-api-js";

// Pass the key explicitly, or set BLITZ_API_KEY and call new BlitzAPI().
// The SDK sends it in the x-api-key header on every request.
const client = new BlitzAPI({ api_key: "YOUR_API_KEY" });

Using an AI tool? The MCP Server can sign you in with your Blitz account via OAuth, so there’s no key to copy. It also accepts your API key in the same x-api-key header.

Verifying your Key

To check if your key is active, use the GET /v2/account/key-info endpoint. This is a great way to “health check” your integration before running batch jobs.

info = client.account.key_info()
print(info.valid, info.records_remaining, info.max_requests_per_seconds)

const info = await client.account.key_info();
console.log(info.valid, info.records_remaining, info.max_requests_per_seconds);

Response:

{
  "valid": true,
  "id": "key_abc123",
  "records_remaining": 950,
  "next_reset_at": "2026-02-12T17:48:25.199Z",
  "max_requests_per_seconds": 10,
  "allowed_apis": [
    "/search/waterfall-icp-keyword",
    "/enrichment/email",
    "/enrichment/phone"
  ],
  "active_plans": [
    {
      "name": "Unlimited Leads",
      "status": "active",
      "started_at": "2026-01-12T17:48:25.200Z"
    }
  ]
}

Response Fields:

Field	Type	Description
`valid`	`boolean`	`true` if the key is active and can make requests.
`id`	`string`	Internal identifier for your API key.
`records_remaining`	`number` or `"unlimited"`	Records left on your plan. Returns the string `"unlimited"` on unlimited plans.
`next_reset_at`	`string`	ISO 8601 timestamp of when your allowance resets.
`max_requests_per_seconds`	`integer`	Your plan’s rate limit, applied independently per endpoint. Use this value to configure your rate limiter client-side.
`allowed_apis`	`array`	List of endpoint paths your key is authorized to call.
`active_plans`	`array`	Your active subscription(s) with name, status, and start date.

Errors

If authentication fails, the API will return a 401 Unauthorized error.

Code	Meaning	Solution
`401`	Unauthorized	Missing or invalid API key. Check that the `x-api-key` header is present and correct.
`402`	Payment Required	Your key is valid, but your account has reached its limit. Upgrade your plan.
`404`	Not Found	The API Key provided does not exist in our system.

For every other status code, including 422 validation errors, see Errors.

Introduction

Getting Started

Core Concepts

Recipes (Use Cases)

Integrations

Appendix

Authentication

Authentication

The `x-api-key` Header

Example Request

Verifying your Key

Errors

​Authentication

​The x-api-key Header

​Example Request

​Verifying your Key

​Errors

Authentication

The `x-api-key` Header

Example Request

Verifying your Key

Errors