Authentication

How to authenticate against the Plur-e public API with a tenant API key — the bearer header, the four 401 messages, revocation timing and the rate limits that answer 429.

Quick answer

Send your tenant API key in every request as Authorization: Bearer plrapi_…. A key that is unknown, revoked, expired or whose tenant is inactive answers 401 with the code invalid_api_key and a message that says which case it is. A revoked key stops working within one minute. Each key may send 120 requests per minute; the next one answers 429 with no body.

The bearer header

curl -s "https://api.plur-e.com/api/public/v1/bc/methods" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

The key starts with plrapi_ followed by 43 characters (50 in total).
It travels only in the Authorization header. Do not put it in the URL or the body.
Only the public API accepts it. The key does not authenticate anywhere else in Plur-e, and a Plur-e user token does not authenticate on the public API.
The tenant is taken from the key. No header, path or body value can select another tenant.

401 when the key is rejected

A rejected key answers 401 Unauthorized with a WWW-Authenticate: Bearer realm="plure-public-api" header and a problem+json body whose code is invalid_api_key. The detail is one of four fixed messages:

Message	What it means	What to do
`The Plur-e API key is not valid.`	The header is missing, is not a Plur-e key, or the key does not exist	Check the header and copy the key again; if you lost it, create a new one
`The Plur-e API key was revoked.`	An administrator revoked the key	Create a new key
`The Plur-e API key expired on 2026-12-31. Create a new one in Developers > APIs > API keys.`	The key passed its expiry date (the message shows the date)	Create a new key and rotate it in your integration
`The tenant of this Plur-e API key is not active.`	The tenant that owns the key is locked	Contact your Plur-e administrator or support

{
  "type": "https://plur-e.com/docs/developers/errors#invalid_api_key",
  "title": "invalid_api_key",
  "status": 401,
  "detail": "The Plur-e API key was revoked.",
  "code": "invalid_api_key",
  "errorCode": null,
  "traceId": "0HN7…"
}

Revocation

Revoking a key in Developers → APIs → API keys is final. Plur-e keeps the result of a key check in memory for up to 60 seconds, so integrations that still use the key keep working for at most one minute after you revoke it, then every call answers 401 with the "was revoked" message. The window also works the other way: a key that was tried before it existed can keep answering "not valid" for up to a minute after you create it.

Rotate before you revoke

Create the replacement key first, deploy it, check the Usage log to see the old key is no longer used, and only then revoke the old one.

Rate limits

There are two limits. Both use a fixed window of one minute.

Limit	Value	When it is exceeded
Per API key	120 requests per minute	`429 Too Many Requests` with no body
Per client IP address	600 requests per minute across the whole public API, counted before the key is checked	`429` with a problem+json body (`code` = `rate_limited`) and a `Retry-After` header in seconds

Handle a 429 by waiting until the next minute starts (or for the Retry-After seconds, when present) and retrying with a short back-off. The per-key 429 has no Retry-After header, so spread your calls instead of sending them in bursts. Requests rejected by the IP limit are not written to the Usage log.

Licence and scopes

After the key is accepted, each operation checks two more things:

Licence. If the tenant has no active Developer APIs subscription the call answers 403 with error plure_1320.
Scope. Each operation requires one scope. A key without it answers 403 with error plure_1321 and a message that names the missing scope. See API keys for the list.