Pricing that fits on one screen

A token is the credential the API checks on every request. You send it as an Authorization: Bearer header. You create tokens yourself from your account page, up to the number your plan allows, without asking anyone and without a sales call.

Your plan sets how many tokens can be active at once — the number is on the card above. Revoked tokens do not count towards it. If you are at the limit, revoke one before you create the next.

Give every script, service, and workstation its own token, labelled for what it does. When one leaks, breaks, or is retired, you revoke that one instead of re-deploying everything you own. Labels are for you; we never need to know what a token is for.

The full token is shown once, at the moment you create it. We store only its prefix and a hash of the secret, so we cannot show it to you again and we cannot recover it for you. If you lose one, create a replacement and revoke the old one.

One request is one query. Each pagination page is a query. Requests rejected with a 4xx input error, a 429, or a 5xx are not counted. Empty results are counted. Every token on your account draws from the same monthly allowance.

An investigation lookup costs up to 8 units, stated before it runs; a further page costs 1.

When you have used the queries included in your plan, further queries return a 403 with the date your allowance resets. Nothing extra is charged, and nothing is quietly slowed down. You upgrade, or you wait for the reset. There is no overage billing on any plan.

On a paid plan your allowance resets on your billing anniversary — the same day of the month you subscribed. On the free plan it resets at the start of each calendar month, UTC. Either way the exact reset date is on your usage page, and in the error you get when you reach the limit.

Each plan also has a per-minute request limit, shown on the card above. Going over it returns a 429 with a Retry-After header telling you how many seconds to wait. A 429 does not count against your monthly allowance. The limit applies to the account, not to each token, so splitting traffic across more tokens does not raise it.

A failed payment does not switch anything off straight away. Your plan keeps working for 7 days while the payment is retried, and the site tells you what needs fixing. After that, lookups stop until the payment goes through. Your tokens, their labels, and your usage history are untouched, and everything resumes as soon as the invoice is paid.

You can cancel at any time from the billing page. You keep the plan you paid for until the end of the period you have already paid for, and then the account moves to the free plan and its limits. Nothing is deleted when you cancel.

A token belongs to the account that created it. Do not share tokens outside your own organisation, resell access, or republish bulk results as your own dataset. Those are the terms tokens are issued under; the acceptable use policy has the full list.

You can revoke any token whenever you like, and it stops working immediately. We revoke tokens as well, without notice, when an account is used to attack or harass, to work around caps or rate limits, or in any of the other ways the acceptable use policy prohibits. Billing problems never revoke a token — only you and an abuse decision do.

A token stays valid until it is revoked. There is no expiry date, no forced rotation, and no email warning you that a key is about to stop working. Rotating on your own schedule is a good habit; we do not impose one.