Developers

Every way in reaches the same account, the same credits and the same projects as the dashboard.

Create an API key in your dashboard under API & MCP. Keys unlock with your first credit purchase. Then:

Check your account

curl https://indexerpal.com/api/v1/account \
  -H "Authorization: Bearer ipk_YOUR_KEY"

See what a list will cost

curl https://indexerpal.com/api/v1/estimate \
  -H "Content-Type: application/json" \
  -d '{"kind": "standard", "urls": ["https://example.com/new-post", "https://example.com/launch"]}'

Index the URLs

curl https://indexerpal.com/api/v1/projects \
  -H "Authorization: Bearer ipk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: launch-2026-10-06" \
  -d '{"urls": ["https://example.com/new-post", "https://example.com/launch"], "mode": "instant"}'

The answer is the new project. Standard indexing costs 1 credit per URL and instant indexing 3. Every URL is checked in Google (instant URLs within the hour, all URLs on day 4 and day 14).

Follow the results

curl https://indexerpal.com/api/v1/projects/PROJECT_ID -H "Authorization: Bearer ipk_YOUR_KEY"
curl "https://indexerpal.com/api/v1/projects/PROJECT_ID/links?status=not_indexed" -H "Authorization: Bearer ipk_YOUR_KEY"

Send a credential in the Authorization header as a bearer token. Cookies are never accepted by the API, MCP or agent endpoints.

API keys

• Made in the dashboard (API & MCP), after the account's first credit purchase. Up to 10 active keys.
• They look like ipk_... and are shown once. Store them as secrets; revoke a key the moment it may have leaked.
• Authorization: Bearer ipk_..., or X-API-Key: ipk_... for tools that prefer a plain header.

OAuth 2.1

For apps acting for other people, and for MCP clients (they do this for you). Authorization code with PKCE (S256), public clients only, registered by the app itself.

Access tokens last 60 minutes. Refresh tokens last 30 days and rotate on every use; reusing an old one disconnects the app. The token endpoint also accepts urn:ietf:params:oauth:grant-type:jwt-bearer and urn:workos:agent-auth:grant-type:claim for agent registration.

Paid accounts

Reading an account and buying credits work for any account. Creating projects and checks needs an account that has bought credits at least once; until then those calls answer 402 payment_required with a link to buy.

API keys get all three unless you untick some when you create them. On the OAuth consent screen, the account owner can narrow what an app gets.

Every authenticated response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset for the per-minute window, and RateLimit-Policy. Over a limit you get 429 with Retry-After in seconds. Daily counts reset at midnight UTC. Your dashboard shows today's usage.

Credits are the real budget: a call that would spend more credits than the balance answers 402 insufficient_credits and spends nothing.

Calls that spend credits or start a payment (POST /projects, POST /projects/from-sitemap, POST /checks, POST /checkout) accept an Idempotency-Key header (MCP tools take an idempotency_key argument). A retry with the same key and the same body returns the first answer, with Idempotent-Replayed: true, and spends nothing twice. The same key with a different body answers 422 idempotency_mismatch; while the first call is still running, 409 idempotency_in_flight. Keys are kept 24 hours.

Every error has the same shape, with a stable code to branch on and a message written for a person or an agent:

{
  "error": {
    "code": "insufficient_credits",
    "message": "This needs 300 credits and the balance is 120. Buy a pack with buy_credits (POST /api/v1/checkout).",
    "needed": 300,
    "balance": 120,
    "docs": "https://indexerpal.com/developers/api#errors"
  }
}

The full list of codes is in the API reference.

Agents can find everything on their own from these files. Every page also sends a Link header pointing to them.

Every public page is available as Markdown, which costs an agent a fraction of the tokens of the HTML. Ask for it with Accept: text/markdown, or add .md to the path: /index.md, /pricing.md, /developers.md.

The API is versioned in its path (/api/v1). New fields and endpoints can appear in v1 at any time, so ignore fields you don't know; anything that would break a working client gets a new version. Questions, higher limits or a bug: write to [email protected].