Authentication
Every request to the GhostCite API is authenticated with your API key, sent as a bearer token. You can generate a key yourself, with no need to contact us.
1. Get your API key
- Create a free account (magic link or Google sign-in).
- Open your account menu and go to Profile → Account → Developer Tools.
- Generate Your API Token. Copy it and store it somewhere safe, and treat it like a password.
You can regenerate the token at any time from the same screen; regenerating immediately invalidates the previous one.
2. Authenticate your requests
Send the key in the Authorization header as a bearer token on every request:
Authorization: Bearer <YOUR_API_KEY>For example:
curl https://app.rule26ai.com/api/v1/verify \
-H "Authorization: Bearer $GHOSTCITE_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "items": [ { "id": "r_1", "type": "case", "rawText": "347 U.S. 483" } ] }'GhostCite API key ≠ CourtListener API key. When you use the free GhostCite web tool, you may be asked to add a CourtListener API key to raise your daily lookup limit. That is a separate, third-party key for the web tool. It is not your GhostCite API token and is not used to authenticate the Developer API. For the API, use only the token from Developer Tools.
Keeping your key safe
- Never embed the key in client-side code, mobile apps, or public repositories, call the API from your server.
- Store it in an environment variable or secret manager (e.g.
GHOSTCITE_API_KEY), not in source. - If a key is exposed, regenerate it from Developer Tools; the old key stops working immediately.
What happens without a valid key
A missing or malformed Authorization header returns 401 Unauthorized; a valid-but-unauthorized key returns 403 Forbidden. See Errors & Rate Limits.