Computational APIs•Security & Quotas
Authentication & API Keys
All requests to the AION Public Intelligence API require a cryptographically provisioned API key. Keys are bound to institutional authorization tiers and require TLS 1.3 encryption.
Header Format
Pass your secret key in the X-AION-Key header or standard HTTP Bearer authorization header:
# Preferred Custom Header
X-AION-Key: aion_live_8f3d1b9e2c4a...
# Or Standard Bearer Header
Authorization: Bearer aion_live_8f3d1b9e2c4a...
Institutional Access Tiers & Rate Limits
| Tier | Rate Limit | Monthly Quota | Substrate Scope |
|---|---|---|---|
| Academic & CivicRESEARCH | 60 req/min | 10,000 queries / mo | Public gazettes, education discourse, basic contradiction graph. |
| Institutional DeskPROFESSIONAL | 600 req/min | 100,000 queries / mo | All domains, high-frequency signals, full SHA-256 S3 artifact viewer. |
| Sovereign / EnterpriseSOVEREIGN | Custom / Dedicated | Unlimited Data License | Direct PostgreSQL replica access, real-time webhook feeds, SLA guarantees. |
Key Hygiene & Security Best Practices
- Never expose keys in client-side code: Always proxy API calls through your Next.js API routes, FastAPI backend, or Laravel orchestrator.
- IP Whitelisting: Enterprise keys can be restricted to specific institutional CIDR blocks in the Developer Mission Control.
- Automatic Revocation: If a key is detected in a public GitHub repository, our automated scanners revoke it within 90 seconds.
Next Module
Error Taxonomy & Epistemic Failures