Authentication
Authenticate SearchIn API requests with an ov_ API key.
Authenticated endpoints require an API key in the x-api-key header. Create keys in Dashboard → API keys.
x-api-key: ov_your_secret_key
Content-Type: application/jsonKey format
Secrets are prefixed with ov_. The full value is shown once at creation. OSINTverse stores a hash, not the plaintext secret.
Rate limits
Each key is limited to 1,000 requests per day. Create, poll (GET /v1/search/:id), and each job inside a bulk batch count toward that quota (bulk is one HTTP call but N billable searches). Rotate or create additional keys from the dashboard if you need isolation between apps.
Public vs authenticated
| Endpoint | Auth |
|---|---|
GET /health | None |
GET /v1/providers | None |
POST /v1/search | Required |
POST /v1/search/bulk | Required |
GET /v1/search/:id | Required |
Unauthenticated or invalid keys return 401. A banned account returns 403. See HTTP errors.
Dashboard session vs API key
The SearchIn UI uses your logged-in session through the Next.js BFF and charges the active workspace (personal or team). Scripts, CI, and third-party apps should use x-api-key against https://apiv1.osintverse.com — never call internal Next.js /api/* routes with an API key.
- Personal keys always bill
user.balance. They ignore any team context. - Team keys are created while a team workspace is selected. They always bill that team’s wallet. See Teams for shared wallets and roles. For SSO, MFA, allowlists, and audit export, see Enterprise onboarding.