Get a free API key for the Sri Lanka vehicle import tax API

Do I need a key?

Probably not. The REST API, the MCP server and the embedded calculator all work without one. Start there; ask for a key when you hit a limit.

	No key	Free key (default)
REST API	30 a minute, 500 a day, shared by everything on your IP address	120 a minute and 10,000 a day, counted for you alone
MCP server	300 a minute, 20,000 a day per IP address	The key's own limits
Use from a web page	Any website may call the API from a browser	Optionally only your own website(s)
Support	Best effort	We know who you are and can warn you before changing anything

You will want a key if:

your website or app serves many visitors from one server address;
an office, school or hosting provider shares one address with many callers;
you want the key to work only from your domain, so no one else can use your quota;
you want us to be able to reach you about changes to the API.

Request a key

What happens next

You send the form. It is checked and stored; nothing is sent to anyone else.
A person reads it, usually within a few working days. We may write back with a question about the use or the volume.
If approved, we e-mail you the key once. We store only a fingerprint of it, so we cannot show it again. If you lose it, ask for a new one and we revoke the old.
You add the key to your server (below). It takes effect straight away; a revoked key stops working within a minute.

Requests for unclear or abusive use may be declined. Using the open API without a key is always still possible, within its limits.

Using your key

Send it with every request, either as X-API-Key or as Authorization: Bearer. It works on every /api/v1 endpoint and on the MCP server.

X-API-Key header

curl "https://autoimports.webgen.live/api/v1/quote?class=petrol&cc=1000&age=1&cif=1200000&currency=JPY" \
  -H "X-API-Key: aik_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Bearer token

curl "https://autoimports.webgen.live/api/v1/tax-classes" \
  -H "Authorization: Bearer aik_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

From your server

// Next.js route handler, Express, Cloudflare Worker…: the key stays on your server
const res = await fetch("https://autoimports.webgen.live/api/v1/calculate", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": process.env.AUTOIMPORTS_API_KEY,
  },
  body: JSON.stringify(request),
});

Status	Meaning
`401 invalid_api_key`	The key is wrong or has been revoked. Leave the header out to use the open limits.
`403 origin_not_allowed`	The key is limited to certain websites and this request came from another.
`429 rate_limited`	Over your limit. Wait for the `Retry-After` seconds, and read the `RateLimit-*` headers.

Keep it safe

Keep it on your server. A key placed in a web page or a mobile app can be read by anyone and then used up. Call the API from your back end, or ask us to limit the key to your website.
Do not post it in public code, chats or screenshots. If it leaks, write to us and we revoke it.
Use environment variables, not source files.