Authentication

The AI Search API uses Bearer token authentication. Every request must include an Authorization header with your API key:

Authorization: Bearer <API_KEY>

Requests that send or receive JSON should also set Content-Type: application/json.

Get an API key

Create and manage keys from your dashboard at aisearchapi.dev. New accounts start with 500 free credits — no card required. Sign-up requires a work email address — personal and disposable providers (gmail, outlook, etc.) aren’t accepted.

Go to aisearchapi.dev and sign in (or create an account).

Create your team workspace

On first sign-in you’ll be asked to create a team — every workspace on AI Search API is a team, so keys, credits, and billing all live under it. Name it and continue; you can invite teammates later from Settings → Members.

Create a key

In your team workspace, open Settings → API Keys and generate a new key. Copy it immediately — the full value is shown only once.

Store it as an environment variable

Keep the key in a server-side secret, for example AISEARCH_API_KEY. Never commit it to source control.

Authenticate a request

Send the key in the Authorization header on every call.

curl https://api.aisearchapi.dev/v1/search \
  -H "Authorization: Bearer $AISEARCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "best crm for startups",
    "surfaces": ["chatgpt"]
  }'

const res = await fetch('https://api.aisearchapi.dev/v1/search', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.AISEARCH_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    query: 'best crm for startups',
    surfaces: ['chatgpt'],
  }),
});

const data = await res.json();

import os
import requests

res = requests.post(
    "https://api.aisearchapi.dev/v1/search",
    headers={
        "Authorization": f"Bearer {os.environ['AISEARCH_API_KEY']}",
        "Content-Type": "application/json",
    },
    json={
        "query": "best crm for startups",
        "surfaces": ["chatgpt"],
    },
)

data = res.json()

Keep keys server-side

Your API key is a secret. Anyone who holds it can spend your credits. Never ship it in a browser, mobile app, or any other client you don’t control — bundled JavaScript, source maps, and network tabs are all readable by end users.Call the API only from your backend, a serverless function, or another trusted server-side environment, and proxy requests from your frontend through it.

If a key is ever exposed, revoke it in the dashboard and issue a new one.

Auth errors

Every error response uses the same flat envelope — a stable code, an actionable error message, the request’s correlation id, and a deep link into the error catalog:

{
  "code": "AUTH_INVALID",
  "error": "missing or invalid API key; send Authorization: Bearer <API_KEY>",
  "request_id": "req_9f2c1a7e4b5d48f1a3c6e8d0b2a4f6c8",
  "docs_url": "https://docs.aisearchapi.dev/guides/errors#auth_invalid"
}

There are two authentication-specific error codes, both returning 401:

AUTH_INVALID

401

Returned by the core data-plane endpoints (POST /v1/search, GET /v1/jobs, /v1/usage, /v1/artifacts) whenever the key is unusable — this covers a missing Authorization header, a malformed header, and a well-formed key that is wrong, revoked, or unknown. On these endpoints, a missing key and an invalid key are indistinguishable.

AUTH_MISSING

401

Returned only by the account-management endpoints when no Authorization header is sent. The core data-plane endpoints never emit this — they return AUTH_INVALID instead.

If you get AUTH_INVALID with a key you believe is set, check that your HTTP client actually forwards the header — some tools strip Authorization on redirects, and empty environment variables silently produce Bearer with no token.

No auth required for health

The liveness endpoint is public and does not require a key:

curl https://api.aisearchapi.dev/v1/health

{
  "status": "ok",
  "schemaVersion": "2026-06-27",
  "bindings": { "artifacts": true, "edgeCache": true, "hyperdrive": true }
}

Every other endpoint requires a valid Bearer token — with two deliberate exceptions. The discovery endpoints GET /v1/surfaces and GET /v1/regions are intentionally public, so an agent or client can enumerate the live capability matrix and region targeting before it has a key. Their data is public and safe. Every other /v1/* route returns 401 AUTH_INVALID without a valid key.

Make your first request

Send a search and read the result, end to end.

Introduction

Guides

Get an API key

Authenticate a request

Keep keys server-side

Auth errors

No auth required for health

Make your first request

​Get an API key

​Authenticate a request

​Keep keys server-side

​Auth errors

​No auth required for health

Make your first request

Get an API key

Authenticate a request

Keep keys server-side

Auth errors

No auth required for health