Authentication
All API requests require authentication via a bearer token.
Obtaining a Token
- Log in to your dashboard
- Navigate to API Tokens
- Click Create Token
- Copy the token immediately. It will not be shown again
You can create multiple tokens for different applications or environments. Rate limits apply per account, so all tokens for the same account share a single rate limit pool.
Using the Token
Include the token in the Authorization header of every request:
curl -X POST https://metrika.run/api/v1/resources/search \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json"
Example with JavaScript (fetch)
const response = await fetch("https://metrika.run/api/v1/resources/search", {
method: "POST",
headers: {
"Authorization": "Bearer YOUR_TOKEN",
"Content-Type": "application/json"
},
body: JSON.stringify({
resources: [
{ platform: "instagram", type: "account", identifier: "natgeo" }
]
})
});
const data = await response.json();
Example with Python
import requests
response = requests.post(
"https://metrika.run/api/v1/resources/search",
headers={
"Authorization": "Bearer YOUR_TOKEN",
"Content-Type": "application/json"
},
json={
"resources": [
{"platform": "instagram", "type": "account", "identifier": "natgeo"}
]
}
)
data = response.json()
Invalid Token
If a token is missing or has been revoked, the API returns 401 Unauthorized with a WWW-Authenticate header. Tokens do not expire: they remain valid until you revoke them from your dashboard.
Check that you are sending the token in the Authorization: Bearer header and that the token has not been revoked from your dashboard.
Token Security
- Treat tokens like passwords: never expose them in client-side code, logs, or version control
- Store them in environment variables or a secure secrets manager
- Regenerate tokens from the dashboard if you suspect they have been compromised
- Delete unused tokens to keep your account secure