Authentication and rate limits
Without a key
200 calls per day per IP address. No registration, no header. The first curl has to work — friction at the start kills more projects than a low ceiling does.
With a key
10,000 calls per month, free during the beta:
curl -H 'X-API-Key: ka_your_key' 'https://api.kart-api.se/v1/geocode?q=Motala'
curl 'https://api.kart-api.se/v1/geocode?q=Motala&key=ka_your_key'Keys are issued by hand during the first weeks of the beta: email us with what you are building and you get one the same day. A self-service form comes when we know somebody wants it — we don't build things that only pay off if the experiment succeeds.
What counts
Every call to a JSON endpoint, to rendering, to routing and to the MCP server counts as one.
Map tiles, styles and fonts do not count. A single map view fetches dozens of tiles; if they counted, the daily quota would be gone before the map finished drawing once. They are rate-limited per second instead, like everything else: 10 per second with room for bursts.
Read the quota from the response
| Header | Meaning |
|---|---|
X-Kartapi-Kvar | Calls left in the period. |
X-Kartapi-Tak | The ceiling (200 per day or 10,000 per month). |
X-Kartapi-Nyckel | nyckellos (keyless) or the key id, so you can see which quota you landed in. |
X-Kartapi-Kvot: omatt | The counter was unreachable. The call went through but was not counted. |
That last line is deliberately visible. A counter that cannot be reached must not shut the API down for everyone — but it must not stay silent either, or "no traffic" and "no measurement" become the same empty number afterwards.
When the ceiling is reached
HTTP/1.1 429 Too Many Requests
Retry-After: 17400
{"detail":"takten nådd","skal":"200 calls per day per IP address without a key."}Retry-After is seconds until the period rolls over. Back off, and get a key if you hit the ceiling regularly.