Authentication API Reference

Summary

Elimapi supports two authentication methods. Every API request must include credentials in a header.

Method	Header	Use case	Session management
Access Token (JWT)	`Authorization: Bearer <token>`	Applications with a user interface	Periodic login, expiring token
API Key	`x-api-key: <key>`	Server-to-server integration	None, key is tied to your account

Step-by-step guide: Authenticating API requests

Endpoint	Method	Description	Auth required
`/v1/auth/login`	POST	Login with email + password, returns `access_token` and `refresh_token`	No
`/v1/auth/refresh`	POST	Refresh the access token using the refresh token (`authorization` header)	Yes
`/v1/auth/change-password`	POST	Change the password of the logged-in user	Yes
`/v1/me/plan-status`	GET	View plan status: expiration, remaining quota, credit balance	Yes

Login request body:

{
  "email": "[email protected]",
  "password": "password"
}

Login response: { user, access_token, expires_in, refresh_token } — expires_in is the token expiration timestamp (ms).

Subscription: If your plan (Free, Individual, Team, Enterprise) expires, API requests are rejected.
Usage Quota: Every successful request deducts from the monthly request total of your plan.
Credits: When the plan quota runs out, the system automatically deducts from your Credits balance (if any).
Rate Limit: API call speed limits are applied to keep the system stable.

Check your current limits via GET /v1/me/plan-status or the Dashboard.

Error	Meaning	How to handle
401 Unauthorized	Token or API Key missing, wrong, or expired	Check the `Authorization` or `x-api-key` header
403 Forbidden	Account locked or insufficient permissions	Check account status on the Dashboard
429 Too Many Requests	Rate limit exceeded	Reduce call frequency or upgrade your plan
400 Bad Request	Quota exhausted and no Credits left	Upgrade your plan or buy more Credits