Authentication
API keys, the Authorization header, rotation, and the limits that apply per key and per account.
All /v1/* endpoints require an API key sent as a Bearer token:
Authorization: Bearer frs_<prefix>_<secret>Only the health probes are unauthenticated.
Creating a key
Create keys in the console under API Keys. Give each key a name that says where it lives (prod-indexer, staging, ci). The plaintext is shown once at creation and is never recoverable; only an Argon2id hash is stored. If you lose a key, revoke it and mint a new one.
You can hold up to 50 active keys per account.
Rotation
Keys are independent, so rotation is zero-downtime:
401 immediately.Scope and isolation
A key acts for the whole account: every collection, batch, webhook and wallet call. Face vectors are namespaced per account and are never searchable across accounts. If you need separate blast radii for separate products, use separate accounts and invite your team to each.
Limits
| Limit | Behaviour |
|---|---|
| Requests per second, per key | Excess returns 429. Back off and retry with jitter. |
| Concurrent in-flight requests, per account | Excess returns 429. |
| Encoded image size | Images over 30 MB return 413. |
| Wallet at zero | Billable calls return 402 Payment Required; control-plane calls keep working. |
Batch indexing runs on its own queue and is the right tool once you have more than a few hundred photos to send at once. See batch and webhooks.
Keep keys off the client
A key spends your credits, so it belongs on a server you control. Browser and mobile apps should call your backend, which calls SightRadar. The console playground is the one browser surface that touches the API directly, and it does so through the console's own session, never with a raw key.
Environment variables
Both official SDKs read SIGHTRADAR_API_KEY when no key is passed explicitly:
export SIGHTRADAR_API_KEY="frs_..."