# webapi.id

> Multi-API gateway for Indonesian developers. One account, one API key
> per product, all products served from `https://api.webapi.id/v1/{product}`.
> Authenticate every request with an `X-API-Key: wak_live_...` header.
> Every error response is `{"error": "<message>"}` unless a product's own
> reference says otherwise (see otpauth below for the one exception).

This file follows the [llms.txt](https://llmstxt.org) convention: a
short, structured entry point for an LLM/agent integrating with this
API, distinct from the human-oriented rendered docs at the same domain
(`https://docs.webapi.id`). Every link below resolves relative to that
domain. Two other hosts matter and are neither of those: the actual API
calls go to `https://api.webapi.id`, and sign-up/key management is at
`https://webapi.id` (marketing/sign-in) and `https://console.webapi.id`
(dashboard) — this file only documents the API itself.

## Start here

- [Getting Started](/guide/getting-started.html): base URL, first request, response shapes, list of products.
- [Authentication](/guide/authentication.html): the `X-API-Key` header, one key per product (not per account), how key reveal/regenerate/revoke works.
- [Errors](/guide/errors.html): the standard `{"error": "..."}` envelope and the full HTTP status code table.
- [Rate Limits](/guide/rate-limits.html): monthly quota vs. per-minute burst limit, the `X-RateLimit-Remaining`/`Retry-After` headers, and explicit retry guidance for an autonomous agent.

## Products

- geodoc — Indonesia regional data & postal codes (provinsi/kabupaten/kecamatan/kelurahan). **Live.**
  - [OpenAPI spec](/openapi/geodoc.yaml): machine-readable source of truth — fetch this directly rather than parsing the rendered HTML reference.
  - [Rendered reference](/api/geodoc.html)
- otpauth — Email OTP send & verify, issuing a bearer session token. **Private testing** — a key needs an explicit grant before it works even if otherwise valid; see the spec's own description.
  - [OpenAPI spec](/openapi/otpauth.yaml): also documents a second, non-standard error-response shape used only by this product (it proxies to a third-party service and forwards that service's own errors verbatim) — read this before assuming every error here matches the gateway-wide `{"error": "..."}` shape from the Errors guide above.
  - [Rendered reference](/api/otpauth.html)

## Notes for an agent calling this API autonomously

- Every OpenAPI file above is the actual contract this gateway implements — it's generated from and versioned alongside the Go source, not hand-maintained documentation that can drift from behavior. Prefer it over any natural-language description, including this file, if the two ever disagree.
- A `429` from the per-minute burst limit includes `Retry-After` (seconds) — wait exactly that long, then retry once. A `429` from the monthly quota has no useful retry window; stop and surface it, don't loop.
- A `503` means the gateway itself failed closed (e.g. its Redis backend is down) — short exponential backoff is reasonable, this is not a signal that your key or request is wrong.
- Getting a key requires a human: GitHub OAuth sign-in at `https://console.webapi.id`. There is no unauthenticated or agent-only provisioning path today.