How to provide API key?

[rkg-mm]

Hi,

I am trying to call the API with configured API key, but it is not used (anonymous pool indicated by response headers, and the management UI shows the API key was "never used").

What am I doing wrong?

curl -i --request POST ^
  --url "https://packages.ecosyste.ms/api/v1/packages/bulk_lookup" ^
  --header "Content-Type: application/json" ^
  --header "Authorization: Bearer xxxxxxxxx" ^
  --header "User-Agent: mailto@xxx@example.com" ^
  --data "{  \"purls\": [    \"pkg:npm/file-entry-cache@6.0.1\"  ]}"

Providing the email in User-Agent header at least joins the polite pool, but still anonymous user. Without it its the anonymous pool.

x-ratelimit-limit: 15000
x-ratelimit-remaining: 14999
x-ratelimit-reset: 1773313200
x-ratelimit-tier: polite
x-ratelimit-consumer: anonymous

Assuming the API key is the one generated in https://ecosyste.ms/account/api_key?
Thanks!

[andrew]

@rkg-mm can you provide the full list of response headers? I think cloudflare caching may be getting in the way of things

[rkg-mm]

@andrew sure:

HTTP/1.1 200 OK
Date: Thu, 12 Mar 2026 10:45:38 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
x-ratelimit-limit: 15000
x-ratelimit-remaining: 14999
x-ratelimit-reset: 1773313200
x-ratelimit-tier: polite
x-ratelimit-consumer: anonymous
Vary: Accept-Encoding
vary: Origin
etag: W/"ac12e6d49a56e5121ab642e9bdf0620a"
cache-control: max-age=0, private, must-revalidate
x-request-id: 67592a59-931d-4c33-b8e2-1555d3dbe1e7
x-runtime: 0.130333
strict-transport-security: max-age=631138519
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 0
x-download-options: noopen
x-permitted-cross-domain-policies: none
content-security-policy: default-src 'self'; connect-src 'self' *.ecosyste.ms server.ethicalads.io; font-src 'self' fonts.gstatic.com; img-src 'self' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdnjs.cloudflare.com unpkg.com static.cloudflareinsights.com media.ethicalads.io server.ethicalads.io; style-src 'self' 'unsafe-inline' fonts.googleapis.com unpkg.com
Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=e%2FlvDAsBxDL0zRJpgKzMKYlQsB1pzmt8VbQzqilAoZVb0%2FCW5%2B%2Fv3fecK%2Fftq7wB7xBk%2BI1ru4mxQ0BEkz%2BgsI1DtHBIDr8tkCwh8PRL3Os7jKDSa6b7MCyE8wZH0ka6"}]}
Server: cloudflare
Apisix-Cache-Status: BYPASS
cf-cache-status: DYNAMIC
CF-RAY: 9db235e02ab9d34e-FRA
alt-svc: h3=":443"; ma=86400