Docs/Get Started

Authentication

Create an API key and send it with every request.

Authenticate by passing your API key as a Bearer token in the Authorization header.

API keys are created in the Solarium dashboard at Settings > API Keys. API keys start with sol_ and are shown once at creation. Store them securely. Only the SHA-256 hash is stored on our end.

API keys are scoped to a single organization. You cannot access another organization's data with an API key. Admin operations (managing members, creating other API keys) are not available via API key.

Rate Limiting

API key requests are limited to 5,000 requests per hour per API key. The limit resets on a rolling 1-hour window from the first request.

Every API key response includes rate limit headers:

• X-RateLimit-Limit: your hourly quota (5000)
• X-RateLimit-Remaining: requests left in the current window

If you exceed the limit, requests return 429 Too Many Requests with a Retry-After header. JWT-authenticated requests (dashboard sessions) are not rate limited.

Example

# API Key auth (recommended for integrations)
curl -X POST https://api.trysolarium.com/graphql/ \
  -H "Authorization: Bearer sol_abc123..." \
  -H "Content-Type: application/json" \
  -d '{"query": "{ myOrganizations { id name } }"}'

# JWT auth (for user sessions)
curl -X POST https://api.trysolarium.com/graphql/ \
  -H "Authorization: JWT eyJhbGciOiJIUzI1NiIs..." \
  -H "Content-Type: application/json" \
  -d '{"query": "{ myOrganizations { id name } }"}'

# Unauthenticated request
{
  "errors": [
    { "message": "Authentication Required." }
  ]
}

# Wrong Organization
{
  "errors": [
    { "message": "API Key Not Authorized For This Organization." }
  ]
}

# Rate limit exceeded (429)
{
  "errors": [
    { "message": "Rate Limit Exceeded. 5,000 Requests/Hour." }
  ]
}
# Headers: Retry-After: 60