API protection

Limits and an IP allowlist you set for your own keys, and the endpoint that reads them.

GETPOST/api/v1/limits

Nothing here is on until you turn it on, under API protection on your account page. Each rule covers every key on the account.

Rule	What it does
IP allowlist	Only these IP addresses or ranges (CIDR, IPv4 or IPv6) can use your keys. Everything else gets `E1702`.
Daily spending limit	The most the API may spend per day, reset at 00:00 UTC. An order that would cross it gets `E1708`.
Per-order limit	The most one purchase may cost (`E1706`).
Max accounts per request	The most accounts one request may buy (`E1705`).
Purchases per hour	How many purchases the API may make in a rolling hour (`E1707`).
Allowed products	Only the products you tick can be bought through the API (`E1704`).
Pause	One switch that stops every API purchase at once (`E1703`).
Read-only keys	Per key. It can check balance, stock, products, orders, the ledger and webhooks, but never sees logins and cannot buy, replace or change webhooks (`E1701`). Good for a monitor or a teammate.
Alerts	A Discord DM when a request is blocked, so a leaked key shows up the first time someone tries it.

Pause and the spending, hourly, quantity and product rules only stop purchases, pre-orders included. A replacement is only stopped by a read-only key or the IP allowlist. The limits count API purchases only: buying on the website or the partner dashboard is not limited.

Read your limits

/limits returns your settings and what is left today, so your code can stop before it is refused. /me has the settings too, without today's usage.

Request

curl "https://www.nfa.pub/api/v1/limits" \  -H "X-Api-Key: rsk_..."

Response

{  "ok": true,  "paused": false,  "key_scope": "full",  "daily_limit_eur": 50,  "spent_today_eur": 12.3,  "remaining_today_eur": 37.7,  "resets_at": "2026-10-26T00:00:00.000Z",  "per_order_limit_eur": 10,  "max_quantity": 20,  "hourly_limit": null,  "purchases_this_hour": 4,  "ip_allowlist": true,  "allowed_products": null}

A limit you have not set comes back as null. Refused requests are never charged. Always JSON.

Errors

Code	HTTP	Meaning
`E1001`	401	The key is missing, malformed, revoked or unknown.
`E1002`	429	Too many requests. Wait for the minute to roll over and retry. See Rate limits.
`E1702`	403	The request came from an IP that is not on your allowlist.

Rate limit: 120 requests a minute per IP address.