Authentication

Send your key in the Authorization header of every request:

Authorization: Bearer al_test_…

These need no key at all: GET /v1/meta/conventions.

Key kinds

Kind	Starts with	What it does
Test	`al_test_`	Real engine, never charged; `meta.mode` is `test`. Each project has a daily allowance of test calls, shared by all its test keys.
Live	`al_live_`	Spends your plan's credits. Only successful (2xx) calls are charged.
Publishable	`al_pub_`	For widgets in the browser: read-only operations without birth data, and only from the web origins you list.

Test and live keys are secret. Use them only from your server, never in a web page or a mobile app.

Publishable keys

A publishable key can call only these operations:

GET /v1/panchang Panchang for a date and place
GET /v1/panchang/choghadiya Day and night choghadiya
GET /v1/muhurat/activities Supported muhurat activities
GET /v1/panchang/hora Hora: the 24 planetary hours of a day
GET /v1/calendar/tithis Tithi start and end moments between two dates, and the tithi at each sunrise
GET /v1/calendar/ekadashi Every Ekadashi of a year: the vrat date, the tithi and the paran window
GET /v1/calendar/festivals Festivals of a year, each by its own rule, with its windows and moments
GET /v1/horoscope/{sign} Horoscope for one sign
GET /v1/horoscope All 12 signs (publisher feed)
GET /v1/transits Ingresses, stations and combustion between dates
GET /v1/kp/ruling-planets The seven KP ruling planets at a moment and place
GET /v1/kp/horary KP horary (prashna) for a number from 1 to 249

The request's Origin header must exactly match one of the key's allowed origins, such as https://www.example.com. Otherwise the API answers 403 domain_not_allowed. Any other operation answers 403 scope_not_allowed.

Rotating a key

On API keys, choose Rotate. A new key with the same name and settings is created, and the old one keeps working.
Deploy the new key.
Revoke the old key. It stops working on the next request.

When a key is refused

Missing, malformed, unknown, revoked and expired keys all get the same answer, 401 invalid_api_key, so nobody can probe which keys exist.