Authentication

Every request requires an API key, sent in the X-API-Key header. Keys are self-serve: sign in with your rip.fun account and create them in the dashboard — no sales call.

X-API-Key: rip_v1_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Getting a key

  1. Sign in — the same login as rip.fun (wallet, email or Google).
  2. Create a key in the dashboard. The full key is shown exactly once at creation — we store only a hash, so copy it immediately.
  3. Your account starts with free monthly credits; every request the key makes draws from that balance.

You can hold up to five active keys — use separate keys for separate workloads (they share one credit balance but get independent usage reporting and rate-limit windows), and revoke any of them instantly from the dashboard.

Scopes

Card Data API keys carry the read:catalog scope, and it isn't sliced any finer than that: one scope grants the whole catalog — cards, expansions, sealed products and their pricing — across all three games, plus the certificate lookup and Vision. Nothing needs to be enabled per game or per resource, so a key that can read Pokémon cards can already read Azuki sealed product or identify a card from a photo. Features are never gated by plan — a request whose key lacks a required scope gets 403, and everything in this docs tree needs only read:catalog. (A key can also be issued with the narrower vision:identify scope, which unlocks Vision alone.)

Partner products (the Gacha API, tenant fulfillment) use separately-issued keys with their own scopes — see the Gacha API docs.

Key handling

  • Server-side only. Never embed the key in browser or mobile code. Proxy API calls through your own backend, exactly like these docs do (the "Try it" runners go through this site's whitelisted server proxy, so keys never reach your browser).
  • Store the key in a secrets manager / environment variable, not in source control.
  • If you suspect exposure, revoke the key in the dashboard and create a new one. Revocation takes effect immediately on the server that processed it and within 60 seconds on every other API server (each caches key lookups for up to a minute).

Test with your own key

By default, every "Try it" runner uses this site's built-in demo key. Paste your own key into the API key field at the top of the sidebar (or press "Use in docs playground" right after creating one) and every runner and generated curl snippet uses it instead — you'll see your real X-Credits-Remaining tick down in the responses.

  • The key is kept only in this browser tab (sessionStorage, so it's gone when the tab closes; the Clear button wipes it immediately).
  • It is sent only to this site's own server proxy, which forwards it as the X-API-Key header to the whitelisted API paths, never to any third party, and it is never logged or stored server-side.

Limits

300 requests / minute per key on the Card Data API, flat for everyone — see Rate limits. Vision has its own, lower ceiling (60 identifications/minute per key), and the Gacha and Instant Pack APIs have theirs (240/min per key plus concurrency caps — see the Gacha overview). Spend is governed by credits: 1 per catalog request and 5 per Vision identification, with free monthly credits and instant USDC top-ups. Both are reported live in response headers, so your client always knows where it stands.