Skip to main content
Corpus is self-serve. Sign in, create a key, and start querying — there is no approval queue and no per-dataset request. Every account gets the full public data surface immediately; what bounds usage is credits, not permissions.

​
Get a key

Sign up at corpus.onera.app/signup with an email and password, then create a key from your account page. Your account is provisioned with 100,000 credits on sign-up — no approval step.
There is no password reset by email yet, and addresses are not verified. Store your password safely; if you are locked out, contact your Corpus administrator.
You can also do it over the API. Sign in for a session token:
Then create a key with it:
The api_key value is returned once. Corpus stores only its SHA-256 digest, so a lost key cannot be recovered — create a new one and revoke the old. This also means a disclosure of the Corpus database cannot be turned back into working credentials.
Your first sign-in provisions an account and grants 100,000 credits automatically.

​
Use the key

GET /catalog is unauthenticated and free. Everything else needs a key and costs credits.

​
Permissions

Every self-serve key carries the full public surface. You do not request these individually. A valid key without a required permission returns 403 Forbidden.

​
What self-serve does not include

Two surfaces sit outside self-serve because they are legal and privacy controls rather than product gating, and no amount of credit unlocks them:
  • The PII vault. Tokenized PAN and litigation-party records live on an isolated database role and are not reachable from any public credential at any permission. The court-judgment dataset under litigation:read is the separate, public-record surface.
  • Redistribution rights. Reading a dataset is not a licence to republish it. Several sources — including China prices and Indian exchange bhavcopy data — are internal-only precisely because Corpus holds no redistribution licence for them. resale:read is provisioned separately and is not part of self-serve. See Data Provenance.

​
Credits

Each request debits your balance. Reads are cheap; work that fans out across documents or builds an export costs more. Check your balance and the ledger that explains it:
When the balance cannot cover a request, Corpus returns 402 Payment Required — not 403. The distinction is deliberate: your key still holds every permission it needs, so the fix is to top up, not to change your access. The ledger is append-only: a balance is the sum of its entries, so every debit is attributable to a route and a key.

​
Managing keys

Account management uses your session bearer token, not an API key. An API key deliberately cannot mint further keys — otherwise one leaked key would become permanent, self-renewing access. Revocation takes effect immediately. Do not put a long-lived API key in browser source code. Frontend applications should obtain a scoped credential through their authenticated server session.