One header, one scope, three ceilings.

Keys are issued from your account and shown exactly once — we store only a SHA-256 hash of the key and the first sixteen characters for display, so a lost key is replaced, never recovered. Sign up to issue one.

Production keys begin with lf_live_; test keys begin with lf_test_. Treat a key as a password: put it in an environment variable, never in client-side code or a repository. The API is meant to be called from your server — it does not send permissive CORS headers, so a browser cannot reach it from an arbitrary origin anyway.

The header is the standard bearer form. The check is case-insensitive on the Bearer prefix; the key itself is not.

curl "https://api.binding.law/v1/law/text?jurisdiction=us&citation=15-45" \
  -H "Authorization: Bearer $BINDING_API_KEY"

Every error on this API has the same envelope: an error object with a stable machine-readable code and a human message. Switch on the code, never on the message text.

{
  "error": {
    "code": "missing_bearer",
    "message": "Bearer token required"
  }
}

{
  "error": {
    "code": "invalid_key",
    "message": "Invalid API key"
  }
}

A key that is valid but lacks the scope an endpoint needs returns 403 with missing_scope, naming the scope it wanted.

Every law endpoint requires one scope: lookup. Self-service keys are issued with it and it is the only scope a customer can grant themselves — anything broader is staff-issued. In practice this means a key either works across the whole law surface or it is not a law key.

Three ceilings apply to a key, and each has its own code and its own Retry-After, because telling a client to wait sixty seconds against a daily quota just produces 1,440 failed retries a day.

Metered calls bill one unit each; a citation-resolution request bills one unit per citation in the batch. The public endpoints bill zero. What each plan allows is on the pricing page.

Coverage accepts an Authorization header if you send one — it is recorded as a zero-unit call and changes nothing about the answer.