Skip to main content
All API requests require an API key. You can create and manage keys from the Scrip dashboard.

​
Using Your API Key

API keys use the sk_ prefix. Pass your key in the Authorization header: 
curl https://api.scrip.dev/v1/programs \
  -H "Authorization: Bearer sk_your_api_key"
You can also use the X-API-Key header: 
curl https://api.scrip.dev/v1/programs \
  -H "X-API-Key: sk_your_api_key"
Each API key has full read and write access to all resources in your organization. There are no scoped or read-only keys at this time.
Keep your API keys secret. Do not expose them in client-side code or commit them to version control.

​
Rate Limits

Requests are rate-limited per organization:
LimitValueMeaning
Sustained rate10 requests/secondSteady throughput the API allows continuously
Burst30 requestsMaximum requests allowed in a short spike before throttling
All API keys within the same organization share the same rate limit. When exceeded, the API returns 429 Too Many Requests with a Retry-After header. Every response includes rate limit headers:
HeaderDescription
X-RateLimit-LimitMaximum burst capacity
X-RateLimit-RemainingRequests remaining in the current window
X-RateLimit-ResetUnix timestamp (seconds) when the bucket is fully replenished
Retry-AfterSeconds to wait before retrying (only present on 429 responses)
For higher throughput, contact us about enterprise rate limits.

​
Errors

StatusCodeMeaning
401unauthorizedAPI key is missing, invalid, or has been revoked. Check that your Authorization header is set correctly.
403forbiddenThe API key is valid but does not have access to this resource.
429too_many_requestsRate limit exceeded
Error responses follow a standard shape: 
{
  "code": "unauthorized",
  "message": "invalid or revoked API key"
}