Applyra API authentication, rate limits and error codes

Every Applyra API request carries a personal key, in an X-API-Key header or an api_key query parameter. Two sliding windows pace the traffic, 5 requests a second and 60 a minute, and the Unlimited plan allows 10,000 requests a month. Anything refused comes back as JSON with a code field, and the full list is at the bottom of this page.

The same rules apply whether you call the API directly or through the MCP server, which is a client of this API like any other. A prompt that asks an assistant for your rankings spends the same quota as a curl. If you have not made a first call yet, start with getting started with the API.

Pacing a client

The two windows are not the same tool. The per-second one absorbs a spike, the per-minute one is the ceiling you actually live under. That collapses into one rule worth building into any client: pace it just under one request a second and you will never think about the limiter again. A burst of five in a second is fine. Sixty in a minute is not.

When a call does come back refused, read Retry-After. It is a delay in seconds and it is the only number worth acting on: wait it out, retry, and back off further if you are still being held. Retrying straight away inside the same window is refused again, which is a slower route to the same place.

The monthly quota

Ten thousand requests a month is roomy enough that most integrations never look at it: a keyword sheet that refreshes every hour, a Slack bot posting weekly movement, a nightly export all sit well inside it. Those three are written up in the recipes, with the calls each one makes.

Your usage is never a guess. The API section of the dashboard shows the requests made this month and the day the quota renews, and the account usage endpoint returns the same count next to your monthly quota, which is the simplest way for a long-running job to decide whether to start. Past the quota, calls answer QUOTA_EXCEEDED until it renews.

Keeping a key safe

A key inherits the full rights of the account, so treat it as a password: environment variable, never a commit, never a browser. Rotating a key in the API section of the dashboard invalidates the previous one at once, which is the right move if one ever lands somewhere public. The free plan has no API access at all, so a key only exists on the Unlimited plan.

curl -H "X-API-Key: YOUR_API_KEY" \
  https://www.applyra.io/api/v1/applications

curl "https://www.applyra.io/api/v1/applications?api_key=YOUR_API_KEY"

HTTP/1.1 429 Too Many Requests
Retry-After: 1
X-RateLimit-Limit: 5
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1789200000

{
  "error": "Rate limit exceeded. Please slow down.",
  "code": "RATE_LIMITED"
}