Skip to content
Calorie API logoCalorie APIGet API key

API Reference

Nutrition API authentication

Nutrition API authentication is an API key in the X-API-Key header. Public demo routes under /api/v1/public/ need no key and are limited by IP. Keys are created in the dashboard and follow the plan quota.

Authenticated request
curl "https://calorieapiadmin.com/api/v1/search/foods?q=apple" \
  -H "X-API-Key: your_api_key_here"

Getting an API key

  • Create a free account, no credit card required for the Free tier.
  • Choose a plan (you can start on Free and upgrade later).
  • Generate a key from the dashboard under API Keys.

Keep your API key secure

Never expose your API key in client-side code or public repositories. Call the API from your backend, or proxy requests through your own server, and store keys in environment variables or a secrets manager. Keys are hashed at rest on our side and can be revoked and regenerated from the dashboard at any time.

Authentication errors

Auth-related status codes

401Missing or invalid API key. Check the X-API-Key header.
402Monthly quota exceeded. Upgrade your plan or wait for the cycle reset.
403Commercial use not allowed on your plan, the endpoint is not enabled for your plan, or a food-coverage limit was reached.
423Account on a temporary security hold due to unusual activity. Not retryable; contact support to restore access.

Dashboard sessions use JWT authentication after sign-in; API traffic from your applications should always use API keys.

Frequently asked questions

Can I use the API key in a mobile app directly?

Avoid shipping raw API keys in mobile binaries, they can be extracted. Route requests through your backend so the key stays server-side, and enforce your own per-user limits in front of it.

How do I rotate an API key?

Generate a new key in the dashboard, deploy it to your services, then revoke the old key. Revocation is immediate.

Do I need different keys for staging and production?

It is good practice to create separate keys per environment so you can revoke or monitor them independently in the dashboard.