# Access and limits

Keyless where the data is public, a key where it is yours. A name in your User-Agent helps us help you.

## The keyless tier

The index, the live numbers, the games and the platform limits are public because every number on them is public on Roblox already. There is no token to send, nothing there returns 401, 403 or 429, and there is no per-caller limit: the CDN carries the load and each endpoint has a window it holds an answer for.

| Endpoint | Held for | Why |
| --- | --- | --- |
| GET /v1 | 1 hour | The index changes only with a release. |
| GET /v1/live | 5 seconds | The counts Roblox refreshes most often. |
| GET /v1/games | 5 minutes | The list behind the studio's own pages. |
| GET /v1/games/{universeId} | 5 minutes | Read out of the same list. |
| GET /v1/limits | 1 hour | A static list that changes only when the limits page does. |
| GET /v1/limits/{id} | 1 hour | Read out of the same list. |
| Every keyed endpoint | not cached | The answer is yours alone; `cache-control: no-store`. |

## The keyed tier

Everything under your account and every product page marked with a scope needs `Authorization: Bearer <key>`. A key comes from the [keys](https://api.dietbloxycola.com/docs/keys) page, is scoped per product, spends against a per-minute bucket and a monthly quota ([rate limits](https://api.dietbloxycola.com/docs/rate-limits)), and every writing endpoint takes an [Idempotency-Key](https://api.dietbloxycola.com/docs/idempotency). Keyed answers are never cached and carry no CORS headers: they are for your server, not a browser.

## Open CORS on the keyless tier

Every keyless answer carries `access-control-allow-origin: *`, so a browser page on any domain can call it directly. Preflights are answered for `GET` and `OPTIONS` with `content-type` allowed and a one day `max-age`.

HTTP:

```http
access-control-allow-origin: *
cache-control: public, s-maxage=5, stale-while-revalidate=10
content-type: application/json
x-request-id: req_01J9X4Q2M7V8K3B5N6P7R8S9T0
```

## Say who you are

A `User-Agent` naming your app or site, with a way to reach you, is the only thing we ask on the keyless tier. If a client ever misbehaves it lets us write to you instead of blocking a range.

HTTP:

```http
User-Agent: cola-tracker/1.0 (hello@example.com)
```