---
title: "Developers | IndexerPal"
description: "Use IndexerPal from your code, AI assistants and agents: submit URLs for indexing, check them in Google, follow every URL and buy credits."
url: https://indexerpal.com/developers
---

Developers

# Developers

Use IndexerPal from your code, AI assistants and agents: submit URLs for indexing, check them in Google, follow every URL and buy credits.

## 1\. Three ways in

Every way in reaches the same account, the same credits and the same projects as the dashboard.

| You are | Use | Start here |
| --- | --- | --- |
| An AI assistant or agent app (Claude, ChatGPT, Cursor, VS Code...) | The MCP server at https://indexerpal.com/mcp. Sign in with OAuth when the app asks. | MCP server |
| Your own code or a no-code tool | The REST API at https://indexerpal.com/api/v1 with an API key. | REST API reference |
| An autonomous agent with only the user's email | Agent registration (/auth.md), then the API, MCP server or A2A agent. | Agents and payments |

## 2\. Quickstart

Create an API key in your dashboard under **API & MCP**. Keys unlock with your first credit purchase. Then:

### Check your account

```
curl https://indexerpal.com/api/v1/account \
  -H "Authorization: Bearer ipk_YOUR_KEY"
```

### See what a list will cost

```
curl https://indexerpal.com/api/v1/estimate \
  -H "Content-Type: application/json" \
  -d '{"kind": "standard", "urls": ["https://example.com/new-post", "https://example.com/launch"]}'
```

### Index the URLs

```
curl https://indexerpal.com/api/v1/projects \
  -H "Authorization: Bearer ipk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: launch-2026-10-06" \
  -d '{"urls": ["https://example.com/new-post", "https://example.com/launch"], "mode": "instant"}'
```

The answer is the new project. Standard indexing costs 1 credit per URL and instant indexing 3. Every URL is checked in Google (instant URLs within the hour, all URLs on day 4 and day 14).

### Follow the results

```
curl https://indexerpal.com/api/v1/projects/PROJECT_ID -H "Authorization: Bearer ipk_YOUR_KEY"
curl "https://indexerpal.com/api/v1/projects/PROJECT_ID/links?status=not_indexed" -H "Authorization: Bearer ipk_YOUR_KEY"
```

## 3\. Authentication

Send a credential in the `Authorization` header as a bearer token. Cookies are never accepted by the API, MCP or agent endpoints.

### API keys

-   Made in the dashboard (API & MCP), after the account's first credit purchase. Up to 10 active keys.
-   They look like `ipk_...` and are shown once. Store them as secrets; revoke a key the moment it may have leaked.
-   `Authorization: Bearer ipk_...`, or `X-API-Key: ipk_...` for tools that prefer a plain header.

### OAuth 2.1

For apps acting for other people, and for MCP clients (they do this for you). Authorization code with PKCE (S256), public clients only, registered by the app itself.

|  | URL |
| --- | --- |
| Authorization server metadata | https://indexerpal.com/.well-known/oauth-authorization-server |
| Protected resource metadata | https://indexerpal.com/.well-known/oauth-protected-resource |
| Client registration (RFC 7591) | https://indexerpal.com/oauth/register |
| Authorization | https://indexerpal.com/oauth/authorize |
| Token | https://indexerpal.com/oauth/token |
| Revocation (RFC 7009) | https://indexerpal.com/oauth/revoke |
| Signing keys (JWKS) | https://indexerpal.com/.well-known/jwks.json |

Access tokens last 60 minutes. Refresh tokens last 30 days and rotate on every use; reusing an old one disconnects the app. The token endpoint also accepts `urn:ietf:params:oauth:grant-type:jwt-bearer` and `urn:workos:agent-auth:grant-type:claim` for agent registration.

### Paid accounts

Reading an account and buying credits work for any account. Creating projects and checks needs an account that has bought credits at least once; until then those calls answer `402 payment_required` with a link to buy.

## 4\. Scopes

| Scope | Allows |
| --- | --- |
| read | See your balance, projects, link statuses, orders and usage. |
| index | Create indexing projects and index checks (spends credits), cancel unsent links, read sitemaps. |
| purchase | Start credit purchases: checkout links for a person to pay, or direct payments where enabled. |

API keys get all three unless you untick some when you create them. On the OAuth consent screen, the account owner can narrow what an app gets.

## 5\. Quotas and limits

| Limit | Value |
| --- | --- |
| Requests per minute, per API key or connected app | 120 |
| Requests per day, per account (all keys and apps) | 20,000 |
| Projects and checks created per day, per account | 500 |
| URLs per project or check | 10,000 |
| URLs per page when listing a project | 500 |
| Sitemap reads per 10 minutes, per account | 20 |
| Checkout links per hour, per account | 20 |
| Active API keys per account | 10 |
| Requests per minute without a credential, per IP address | 60 |
| OAuth client registrations per hour, per IP address | 20 |
| Agent registrations per hour, per IP address | 10 |

Every authenticated response carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset` for the per-minute window, and `RateLimit-Policy`. Over a limit you get `429` with `Retry-After` in seconds. Daily counts reset at midnight UTC. Your dashboard shows today's usage.

Credits are the real budget: a call that would spend more credits than the balance answers `402 insufficient_credits` and spends nothing.

## 6\. Retrying safely

Calls that spend credits or start a payment (`POST /projects`, `POST /projects/from-sitemap`, `POST /checks`, `POST /checkout`) accept an `Idempotency-Key` header (MCP tools take an `idempotency_key` argument). A retry with the same key and the same body returns the first answer, with `Idempotent-Replayed: true`, and spends nothing twice. The same key with a different body answers `422 idempotency_mismatch`; while the first call is still running, `409 idempotency_in_flight`. Keys are kept 24 hours.

## 7\. Errors

Every error has the same shape, with a stable `code` to branch on and a `message` written for a person or an agent:

```
{
  "error": {
    "code": "insufficient_credits",
    "message": "This needs 300 credits and the balance is 120. Buy a pack with buy_credits (POST /api/v1/checkout).",
    "needed": 300,
    "balance": 120,
    "docs": "https://indexerpal.com/developers/api#errors"
  }
}
```

The full list of codes is in the [API reference](https://indexerpal.com/developers/api#errors).

## 8\. Machine-readable files

Agents can find everything on their own from these files. Every page also sends a `Link` header pointing to them.

| File | What it is |
| --- | --- |
| /openapi.json | OpenAPI 3.1 for the REST API, with payment discovery (x-payment-info). |
| /.well-known/api-catalog | API catalog (RFC 9727): every API with its description and docs. |
| /.well-known/mcp/server-card.json | MCP server card: tools, transport, authentication. |
| /.well-known/agent-card.json | A2A agent card, with the AP2 payments extension. |
| /auth.md | How an agent gets credentials. |
| /.well-known/agent-skills/index.json | Agent Skills: ready-made instructions for agents. |
| /.well-known/acp.json | Agentic Commerce Protocol discovery. |
| /.well-known/ucp | Universal Commerce Protocol profile. |
| /.well-known/ai-catalog.json | Agentic Resource Discovery manifest. |
| /llms.txt | A plain-text summary of the site for language models. |

## 9\. Pages as Markdown

Every public page is available as Markdown, which costs an agent a fraction of the tokens of the HTML. Ask for it with `Accept: text/markdown`, or add `.md` to the path: [/index.md](https://indexerpal.com/index.md), [/pricing.md](https://indexerpal.com/pricing.md), [/developers.md](https://indexerpal.com/developers.md).

## 10\. Versions and support

The API is versioned in its path (`/api/v1`). New fields and endpoints can appear in v1 at any time, so ignore fields you don't know; anything that would break a working client gets a new version. Questions, higher limits or a bug: write to [support@indexerpal.com](mailto:support@indexerpal.com).