Asva AI API: Authentication with Bearer API Keys

Every request to the Asva AI API must be authenticated. Authentication uses API keys issued per workspace — there are no per-user keys, no OAuth flows, and no session cookies. You pass your key as a Bearer token in the Authorization header on every request. The API validates the key, checks your rate limit, and then processes your request.

Get an API key

API keys are issued per workspace. To get yours:

Visit asva-ai.com/get-help and book a call
Or email hello@asva-ai.com with the subject line “API Access”

Your key will arrive in the format asva_live_...

Keep your API key secret. Never commit it to version control or expose it in client-side JavaScript. Store it as an environment variable and access it server-side only.

Pass your API key

Include your key as a Bearer token in the Authorization header on every request:

curl -X POST https://asva-ai.com/api/audit \
  -H "Authorization: Bearer $ASVA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "yourstore.com"}'

const response = await fetch('https://asva-ai.com/api/audit', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.ASVA_API_KEY}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ domain: 'yourstore.com' })
})

import os
import requests

headers = {
    'Authorization': f'Bearer {os.environ["ASVA_API_KEY"]}',
    'Content-Type': 'application/json'
}

response = requests.post(
    'https://asva-ai.com/api/audit',
    headers=headers,
    json={'domain': 'yourstore.com'}
)

Base URL

All API endpoints use:

https://asva-ai.com/api

There is no separate staging or sandbox URL. To test without side effects, pass dry_run: true in the request body — the API returns a valid response using cached data without re-fetching or writing anything.

Error responses

Status	Error code	Description
`401`	`unauthorized`	Missing or invalid API key
`403`	`forbidden`	API key is valid but lacks permission for this resource
`429`	`rate_limited`	Too many requests — see rate limits below

401 response example:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key. Pass your key as: Authorization: Bearer asva_live_..."
  }
}

Rate limits

Endpoint	Limit
`POST /api/audit`	60 requests / hour
`POST /api/manifest`	100 requests / hour
`POST /api/report`	1,000 requests / hour

Rate limit headers are returned on every response:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 47
X-RateLimit-Reset: 1744281600

X-RateLimit-Reset is a Unix timestamp. Wait until that time before retrying after a 429. If you are running batch jobs (for example, auditing multiple client domains), spread requests across the hour rather than bursting all at once.

If you need higher rate limits for agency batch workflows, mention it when you book your onboarding call.

SDK

TypeScript and Python SDKs are in development. Until they are available, use the REST API directly with the examples above.

Next steps

Readiness API

Run a readiness audit against any domain.

Manifest API

Generate and validate UCP manifests.

Attribution API

Log events and pull attribution data.

​Get an API key

​Pass your API key

​Base URL

​Error responses

​Rate limits

​SDK

​Next steps

Readiness API

Manifest API

Attribution API

Get an API key

Pass your API key

Base URL

Error responses

Rate limits

SDK

Next steps