> ## Documentation Index
> Fetch the complete documentation index at: https://help.indolat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication

> How to authenticate requests, validate your API key, read the response format and secure your integration.

Use this page to set up the initial connection before calling any other endpoint.

## General configuration

* Base URL: `https://app.indolat.com/api/v1`
* Authentication: `Authorization: Bearer <API_KEY>`
* Request/response format: `application/json`
* Default rate limit: 120 requests per minute per project; the active value is available from `GET /me`
* Default pagination: 25 items per page, up to 100
* Maximum batch operation: 500 participants per request

Headers required on every endpoint:

```http theme={null}
Authorization: Bearer <API_KEY>
Accept: application/json
```

For requests with a body, also add:

```http theme={null}
Content-Type: application/json
```

### Response format

Successful response:

```json theme={null}
{
  "success": true,
  "message": null,
  "data": {}
}
```

Failed validation response:

```json theme={null}
{
  "success": false,
  "message": "Data yang dikirim tidak valid.",
  "errors": {
    "email": ["Format alamat email tidak valid."]
  }
}
```

Main status codes: `200` success, `201` created, `401` invalid API key, `403` access or add-on denied, `404` data not found, `409` business rule conflict, `422` validation failed, and `429` rate limit exceeded.

> [!NOTE]
>
> The `message` and `errors` texts are always in Indonesian. Rely on `success`, the HTTP status code and the error keys rather than on the text.

## Validate the API key

> [accordion] GET /me — Project profile and usage limits
>
> ### Parameters
>
> This endpoint has no parameters.
>
> ### Example request
>
> ```bash theme={null}
> curl -X GET "https://app.indolat.com/api/v1/me" \
>   -H "Authorization: Bearer <API_KEY>" \
>   -H "Accept: application/json"
> ```
>
> ### Example response
>
> ```json theme={null}
> {
>   "success": true,
>   "message": null,
>   "data": {
>     "client": {
>       "id": 3,
>       "name": "SMA Nusantara",
>       "code": "smanusantara",
>       "app_url": "https://smanusantara.cbt.example.com"
>     },
>     "addons": {
>       "api_integration": true,
>       "registration_page": true,
>       "exam_certificate": false,
>       "custom_domain": false
>     },
>     "exam_credits": { "professional": 250, "free": 25 },
>     "limits": {
>       "rate_limit_per_minute": 120,
>       "max_batch_rows": 500,
>       "max_page_size": 100
>     }
>   }
> }
> ```

## Security notes

* Store the API key on your server only, never in a frontend or mobile app.
* Use the IP whitelist under **Application Settings → API Integration** whenever possible.
* Register only domains you own under **Post-Exam Redirect Domains**. Exam access links accept a `return_url` only on a registered domain and over `https://`.
* Regenerate the API key (**Regenerate API Key**) immediately if you suspect it has leaked; the old key stops working straight away.
* An exam access link acts as a participant login and can be used only once. Create the link when the participant is about to sign in, redirect the participant straight away, and keep the validity period as short as possible.
* Use HTTPS for webhook endpoints, and verify the signature against the raw request body before processing the payload.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.