Authentication

Every request to the managed API (https://api.collimate.ai) and the hosted MCP endpoint (https://mcp.collimate.ai) authenticates with a bearer token in the Authorization header:

curl https://api.collimate.ai/v1/health \
  -H "Authorization: Bearer $COLLIMATE_API_KEY"

The SDK and MCP server read the key from the COLLIMATE_API_KEY environment variable automatically, or you can pass it explicitly.

Key format

A Collimate key looks like:

col_<tier>_<id>_<secret>

• col_ — fixed prefix.
• <tier> — a display hint only (demo, pro, or ent). It is not authoritative: your real tier and limits live server-side in the key record. Editing the segment changes nothing.
• <id> — a 16-character (hex) public lookup id.
• <secret> — a 43-character url-safe base64 secret (32 bytes) from a CSPRNG.

The API looks the key up by <id> and does a constant-time compare of sha256(<secret>) against the stored hash. Keys are shown once at creation and stored only as a hash — Collimate cannot recover a lost key, so create a new one.

Keep keys secret

Treat a key like a password — it carries your tenant's access. Set it via an environment variable or a secrets manager; never commit it. Keys are revocable (soft-delete) from the console; revoke and rotate if one leaks.

Tiers

Every tier runs the same Firecracker microVMs — same isolation, same per-fork performance. Plans gate concurrency, session duration, and support, never the sandbox itself.

Tier	Price	Concurrent sandboxes	Max session	Isolation
Demo	Free, no card	2	1 hour	Shared capacity
Pro	Base + metered usage	No limit	24 hours	Per-tenant scoping
Enterprise	Custom / invoice	Unlimited	Unlimited	Dedicated capacity, SSO, BYOC (contact sales)

Billing is per-second metered CPU / RAM / disk while a sandbox is live, plus snapshot storage per GB-month while it is suspended. Suspending a sandbox stops the meter. Demo is free and capacity-shaped — no card, no dollar credits. See Pricing.

Get a key

Sign in to the console (Google or GitHub), then API keys → Create. A Demo key is available immediately with no card; upgrade to Pro or Enterprise from Billing.

export COLLIMATE_API_KEY="col_pro_b8c6fe77df01a00f_eK_1kL49UzIWgeP46nJFfmZh94iHkkYMwr4ZBCqF804"

Status codes the API returns

The API enforces authentication and quota fail-closed — a missing config, an empty key table, or an unreachable database denies rather than defaults open.

Status	Code	When	What to do
401	unauthorized	No Authorization header, a malformed token, an unknown <id>, a wrong secret, or a revoked key.	Check the key; create a new one if revoked.
403	forbidden	The key is valid but may not address that resource — a template your tenant doesn't own, or a sandbox owned by another tenant.	Use a resource your tenant owns.
429	rate_limited	Per-key request rate exceeded (token bucket, keyed by key id).	Honor Retry-After and back off.
429	quota_exceeded	You are at your tier's concurrent-sandbox cap.	Suspend or delete a live sandbox, or upgrade.

Rate limiting is keyed by key, not IP

The token bucket is keyed by your key id — never by a client-supplied X-Forwarded-For — so you cannot be throttled by another tenant sharing an egress IP, and you cannot dodge a limit by rotating IPs.

Only GET /v1/health is unauthenticated. Every other endpoint requires a valid key. See Errors for the full catalog and the response shape, and Limits for the numbers.