Authentication and keyless
Send a key in a header, or send none and use the free tier: 25 requests per IP per UTC day (IPv6: per /64). Failed keyless requests still count.
API keys
Keys look like a short prefix, then _live_, then 32 lowercase hex characters. ContextFetch stores only the SHA-256 hash of a key. The plaintext key is shown, and copied to the clipboard, on the checkout success page for 24 hours. Send the key in any one of these:
| Where | Used by |
|---|---|
| Authorization: Bearer <key> | Preferred. Also what tavily-python and @tavily/core send. |
| x-api-key | What exa_py and exa-js send. |
| api_key (body) | Tavily requests only. |
Keyless tier
Send no Authorization or x-api-key header, or send Authorization: Bearer guest (or Bearer keyless). You get 25 requests per IP per UTC day (IPv6: per /64). Failed keyless requests still count. Every billable response carries the X-Credits-Remaining header, so your agent always knows how many free requests are left.
x-credits-remaining: 24When the allowance runs out the API answers 402 with a payment link. See the 402 payment loop.