Authentication

Every request carries your API key in an x-api-key header. There is no OAuth flow, no token exchange, and no expiry to handle — one header on every call.

Your API key

Keys are issued per account from the portal. A key is what identifies your account and spends its credits, so treat it like a password: store it in an environment variable or secret manager, never in client-side code or version control.

Authenticated request

curl -X POST https://api.realestateapi.com/v2/PropertyDetail \
  -H "x-api-key: $REALESTATEAPI_KEY" \
  -H "Content-Type: application/json" \
  -d '{"address": "1 Rocket Rd, Hawthorne, CA 90250"}'

Because the key is sent on every call from your own backend, requests must never originate in a browser or mobile app. Proxy them through a server you control.

Headers

Name
x-api-key
Type
string
Description
Your API key. Required on every request.
Name
x-user-id
Type
string
Description
Optional. A unique identifier for the end user this call is being made on behalf of.

Attributing calls to your users

If you are building a product where your own users trigger property lookups, send an x-user-id header identifying that user. It gives you two things:

Per-user rate limiting. Some endpoints apply a separate, tighter per-second limit keyed on x-user-id when it is present. That protects the rest of your traffic from one user's burst — see Rate limits.
Attribution on saved searches. Saved Searches can be filtered by the x-user-id they were created with, which is how you scope a stored list to the user who built it.

The value is yours to choose — any stable identifier for the user works.

curl -X POST https://api.realestateapi.com/v2/PropertyDetail \
  -H "x-api-key: $REALESTATEAPI_KEY" \
  -H "x-user-id: user_8f21c" \
  -H "Content-Type: application/json" \
  -d '{"address": "1 Rocket Rd, Hawthorne, CA 90250"}'

When authentication fails

A missing, malformed, or revoked key returns 401:

{
  "statusCode": 401,
  "error": "Unauthorized Request",
  "message": "x-api-key must be valid",
  "validation": {}
}

A valid key calling an endpoint your plan does not include is a different failure — see Errors for the full list.