# API keys

India API keys are free. Most endpoints keep working without one; a key gives you your own, larger allowance, and the model endpoints will need one.

## What a key gives you

| | Without a key | With a free key |
|---|---|---|
| Counted per | IP address | Key, so apps on a shared address stop sharing one allowance |
| Per minute | 600 units | 3000 units |
| Model endpoints | Until 15 December 2026 only | 500 requests a day in all, one at a time per key |

A unit is what a request costs: a lookup is 1, real CPU work (pictures, astronomy, live network checks) 10, a file worked on 15, a traceroute 20, a model run 30. Every answer says where you stand in the `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` headers, keyed or not. A logo already in the cache costs nothing.

## Get a key

1. [Sign up](https://api.dharun.dev/signup) with your email address. There is no password: we mail you a six-digit code, which works once for 10 minutes. Logging in later works the same way. (Login with Google or GitHub is planned.)
2. On [your account page](https://api.dharun.dev/account), make a key. It is shown once: copy it then. An account holds up to three keys; rotate or revoke them there. A revoked key stops working within a minute.

## Send a key

In a header, never in the address (addresses end up in logs and browser history):

```bash
curl -H "Authorization: Bearer india_live_..." https://api.dharun.dev/v1/pincode/637001
curl -H "X-API-Key: india_live_..." https://api.dharun.dev/v1/pincode/637001
```

Keys start with `india_live_`, so secret scanners can find one that leaked; a mistyped key is refused at once with `401 invalid_key`. MCP clients send the same header from their configuration.

A web page cannot keep a key secret, and an `<img>` tag cannot send a header: use logos and lookups in web pages without a key. Cached logos are free.

## The model endpoints

These run a neural network for each request, so they will need a key:

- `/v1/text/moderate`
- `/v1/transliterate/suggest`
- `/v1/ocr`
- `/v1/image/remove-background`
- `/v1/stt`
- `/v1/tts`
- `/v1/audio/denoise`
- `/v1/embed`
- `/v1/rerank`
- `/v1/translate`
- `/v1/read`
- `/v1/media/convert`
- `/v1/media/trim`
- `/v1/media/waveform`
- `/v1/media/thumbnail`
- `/v1/hooks`
- `/v1/db`
- `/v1/rag`
- `/v1/rag/{id}/documents`
- `/v1/rag/{id}/query`
- `/v1/kv`
- `/v1/doc/markdown`
- `/v1/doc/tables`
- `/v1/doc/invoice`
- `/v1/doc/einvoice-qr`
- `/v1/doc/mask-aadhaar`
- `/v1/doc/receipt`
- `/v1/doc/cheque`
- `/v1/doc/statement`
- `/v1/doc/redact`
- `/v1/llm/summarise`
- `/v1/llm/classify`
- `/v1/llm/extract`
- `/v1/llm/rewrite`
- `/v1/chat/completions`
- `/v1/text/redact` with `names=true` (plain redaction stays keyless)

From **15 December 2026** (midnight India time) a keyless call to them answers `401` with the error code `key_required`. Until then they answer as before, with an `X-Key-Notice` header saying so. With a key, `X-Quota-Limit` and `X-Quota-Remaining` show the day's quota; it resets at midnight India time. Over it, the answer is `429 quota_exceeded`.

The free tool pages on this site (such as [image to text](https://api.dharun.dev/tools/image-to-text)) use a short-lived token of their own, which allows 10 model requests a day per address.

## What we keep

An account holds your email address, the hashes of your keys (never the keys), when they were made, and how many requests each key made per day and API group. The log line of a request to a model endpoint holds the key's id, so abuse can be traced and stopped; other requests log nothing about keys. Deleting your account on the account page removes all of it at once. See [privacy](https://api.dharun.dev/privacy).