Getting started
Authentication and limits
Every request carries the journal's API key in the X-Api-Key header. Requests without a valid key are rejected with 401.
curl https://api.scholvet.com/v1/me \
-H "X-Api-Key: $SCHOLVET_API_KEY"Key format
A key has four parts separated by underscores: sv, the environment (live or test), an eight-character key identifier and the secret. Scholvet stores only a hash of the key, so a lost key cannot be shown again; it is replaced with a new one.
sv_live_7KQ2MX4P_9mX0t…
Keeping the key safe
- Call the API from your server only. Never put a key in browser code, a mobile app or a public repository.
- Keep keys in configuration or a secret store, not in source code, and keep them out of logs.
- If a key may have leaked, replace it in the console. The old key stops working at once.
Systems that host many journals
Store a key per journal and send the key of the journal the article belongs to. Reviewer codes are different for every journal, so a code seen by one journal cannot be used by another.
Rate limits
Each key may send 120 requests per minute. Above that the API answers 429 Too Many Requests; wait until the next minute and retry. A missing or wrong key is answered like this:
HTTP/1.1 401 Unauthorized
Content-Type: application/problem+json
{
"type": "https://tools.ietf.org/html/rfc9110#section-15.5.2",
"title": "Unauthorized",
"status": 401,
"detail": "API key is missing or invalid.",
"code": "invalid_api_key"
}