Setup

This page gets you signed in, issued an API key, and making your first authenticated request.

API_KEY=your_key_here

curl -X POST https://api.inbe.us/v1/search \
  -H "Content-Type: application/json" \
  -H "API-KEY: $API_KEY" \
  -d '{
    "mode": "midpoint",
    "locations": [
      { "lat": 51.5072, "lon": -0.1276 },
      { "lat": 51.5154, "lon": -0.1419 }
    ],
    "preferences": { "establishment": ["coffee_shop"] }
  }'

Security best practice

• Do not expose API keys in client-side code or mobile apps
• Use environment variables/secret managers for server-side storage
• Scope usage and monitor via the dashboard

Rate limits

Rate limits depend on your plan. You’ll see current usage and remaining quota in the dashboard, and standard X-* headers on responses.

Request pricing

We give all new customers £10 credit, giving you over 1600 requests to get started before you need to top up or upgrade to a paid plan.

API Keys

This guide explains how to securely integrate the InBe API into mobile and client-side applications, following industry best practices for API key security. Server-side applications do not need to follow these patterns.

If you are unsure which pattern to use, we recommend the Server Proxy pattern.

Recommended Integration Patterns

Pattern 1: Server Proxy

This pattern is recommended, particularly for large companies.

How it works:

1. Mobile app → Your server → InBe API
2. Secret key stored securely on your server
3. Mobile app uses your own authentication
4. Your server then makes the request to the InBe API using the secret key sk_*

Benefits:

• Maximum security
• Full control over rate limiting
• Can add additional business logic
• Secret key never exposed

Limitations:

• Additional latency
• Additional complexity

Implementation:

app.post("/api/search-establishments", authenticateUser, async (req, res) => {
  const response = await fetch("https://api.inbe.com/v1/search", {
    method: "POST",
    headers: {
      "API-Key": process.env.INBE_SECRET_KEY, // sk_*
      "Content-Type": "application/json",
    },
    body: JSON.stringify(req.body),
  });
 
  res.json(await response.json());
});

Pattern 2: Direct API Access

This pattern can be used if have a smaller scale project or solution and you are not concerned about the security of your API key.

How it works:

1. Mobile app → InBe API directly
2. Public key embedded in mobile app
3. Limited to read-only operations

Benefits:

• Simpler implementation
• Lower server costs
• Faster response times

Limitations:

• Public key can be extracted from app

Example Implementation:

const searchEstablishments = async (location) => {
  const response = await fetch("https://api.inbe.com/v1/search", {
    method: "POST",
    headers: {
      "API-Key": "pk_*", // Public key - safe to embed
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ location }),
  });
 
  return response.json();
};

Security Best Practices

Authentication errors

If authentication fails, you’ll receive a 401 response:

{
  "error": "Unauthorized",
  "message": "Invalid API key",
  "code": 401
}

Next steps