POST https://app.enricho.co/api/account/keys with {"name":"My integration"}, your signed-in session cookie and the required write-request header X-Requested-With: enricho, not an existing REST API key. It returns HTTP 201 with result.id, result.name and result.key; copy the secret immediately because it is only shown once. Names must be nonempty after trimming and at most 60 UTF-8 bytes. At most 20 active keys are allowed; attempting another returns 409 until one is revoked. This account-management route is not a REST key-creation endpoint on mcp.enricho.co.
Enricho keys start with enr_. The examples use placeholders, not working credentials.
Bearer header
Alternative header
user_id cannot select another billing account. Dashboard session cookies are not REST authentication on this host. Missing, malformed, invalid or revoked keys return 401 (unauthorized); authentication outages return 503 (upstream_unavailable). The public plan catalog needs no key.
Request limits
Default direct REST limits include 60 requests per key per minute and 600 per client IP per minute. Authentication-service defaults also limit each credential to 120 requests/minute and the account to 300/minute across keys and OAuth connected apps. Actual limits depend on deployment settings; extra keys do not bypass account limits. Authenticated calls, including free previews and billing calls, are rate-limited. A 429 usesrate_limited. Wait a minute for request-rate errors, with bounded backoff rather than immediate loops. A daily preview-cap error instead requires waiting until midnight UTC or switching to a paid full search. Do not assume a Retry-After header is provided. Preview allowance changes may lag a plan change by up to five minutes.