Developer API · v1.1

Authentication

Every request to the GhostCite API is authenticated with your API key, sent as a bearer token. Keys are issued on request while the Developer API is in limited release.

1. Get your API key

Self-service key generation is not available yet. While the Developer API is in limited release, we issue keys on request.

Create a free account (magic link or Google sign-in).
Email [email protected] from that account’s address and tell us what you’re building.
We issue a key bound to your account. Copy it and store it somewhere safe, and treat it like a password.

Keys do not expire. If you need one replaced, contact us and we will revoke the old key and issue a new one.

2. Authenticate your requests

Send the key in the Authorization header as a bearer token on every request:

Authorization: Bearer <YOUR_API_KEY>

For example:

curl https://app.rule26ai.com/api/v1/verify \
  -H "Authorization: Bearer $GHOSTCITE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "items": [ { "id": "r_1", "type": "case", "rawText": "347 U.S. 483" } ] }'

GhostCite API key ≠ CourtListener API key. When you use the free GhostCite web tool, you may be asked to add a CourtListener API key to raise your daily lookup limit. That is a separate, third-party key for the web tool. It is not your GhostCite API token and is not used to authenticate the Developer API. For the API, use only the GhostCite API key we issued to you.

Keeping your key safe

Never embed the key in client-side code, mobile apps, or public repositories, call the API from your server.
Store it in an environment variable or secret manager (e.g. GHOSTCITE_API_KEY), not in source.
If a key is exposed, contact us right away and we will revoke it and issue a replacement.

What happens without a valid key

A missing or malformed Authorization header returns 401 Unauthorized; a valid-but-unauthorized key returns 403 Forbidden. See Errors & Rate Limits.

Next: Quickstart →