Authentication
One header. Limits per key, reported on every response.
Authorization: Bearer bwk_…Keys start with bwk_ and are 44 characters long. They are tied to the Bandwagon account that created them, hashed at rest, and revocable at any time from the app; revocation takes effect within 30 seconds.
Limits
| Free | Pro | |
|---|---|---|
| Requests per minute | 60 | 600 |
| Requests per month (UTC) | 10,000 | 1,000,000 |
| Sentiment freshness | completed days, one-day lag | today's running day, hourly |
| Attribution | required | not required |
A request refused for the minute limit does not count against the month. A 304 Not Modified does.
Headers
| header | meaning |
|---|---|
X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset | The minute window: allowed, left, seconds until it resets. |
X-Quota-Limit, X-Quota-Remaining, X-Quota-Reset | The month: allowed, left, when it resets (ISO 8601). |
Retry-After | On a 429: seconds to wait. |
X-Attribution | Free tier: the credit you must show wherever the data appears ("Data by Bandwagon (https://bandwagon.fyi)"). |
ETag, Cache-Control, Vary: Authorization | Conditional requests; responses are private to the key. |
Keeping keys safe
- Call the API from a server, not from a browser or a mobile app you ship; a key in a client is a key everyone has.
- One key per integration, named, so you can revoke one without touching the others.
- If a key leaks, revoke it in the app and create another. Usage per key per day is visible at
GET /v1/me/api-keys/:id/usage.