API keys

Under Account → API keys you create keys for the API, the SDK and the MCP server. A key can read and write, or only read. You can also limit it to one or more websites: it then only sees their forms and submissions. Deleting the last of those websites deletes the key too. No key can change the account itself (profile, recipient addresses, plan).

Each key may send 120 requests a minute. The headers X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset show where you stand; above that the API answers 429 with Retry-After. Read submissions page by page with limit (up to 500) and cursor; the X-Next-Cursor header holds the value for the next page. All routes are in the OpenAPI spec.