CarbonGuru API Terms

Last Updated: September 21, 2026

These API Terms apply when you use the CarbonGuru API: the /v1/ endpoints, API keys, and webhooks.
They apply in addition to our Terms of Service and Privacy Policy. If you use
Embedded Offsetting for a store, the Merchant Terms also apply. Where these API
Terms and the Terms of Service differ on a point about the API, these API Terms govern.

1. What the API is

The API is another way to use your CarbonGuru account. It reaches the same features you use on the
website and through AI agents: analyzing products, pages, text and files; reading your analyses and
footprints; quoting and building your own offset cart; reference data; and, for store accounts,
Embedded Offsetting. Everything you do through the API is done as your account.

2. Plans, allowances and charges

API access is part of your existing CarbonGuru plan. There is no separate API fee. The features your
plan includes, and the allowances that come with them, are the same whether you use the website, an
AI agent or the API, and API use counts against the same allowances. A request for a feature your plan
does not include is refused with HTTP 402 and the plan that includes it.

Store accounts that analyze more catalog products than their plan’s allowance can buy additional
analysis at $0.05 per product. That charge is only ever made after you agree to it while signed in to
your account. An API key cannot agree to it.

3. API keys

You create keys in your account at My Account → API. A key is shown once, when it is created.
We store only a keyed hash of it, so we cannot show it to you again. If you lose a key, rotate it.
Each key carries scopes that you choose: what the key may read and do. A key is refused on any
request its scopes do not cover.
You may hold up to 10 API keys at a time, for example one per integration. Each is rotated and
revoked on its own.
Rotating a key creates its replacement and keeps the old key working for 7 days, then ends it.
Revoking a key ends it; requests with it are refused within 15 seconds.
Keep keys secret and use them from your server. Do not put a key in a web page, a mobile app, a
browser extension or a public repository. The API does not accept calls from web browsers on other
sites.
You are responsible for everything done with your keys. If you think a key has been exposed,
revoke it at once.
Your store’s own connection key, used by your store plugin or app, is separate from your API keys.
Creating, rotating or revoking an API key does not change it.

4. What an API key cannot do

Some actions change what your account is charged or how it is set up, and they need you signed in to
your account. No API key can:

accept these API Terms, the Terms of Service or the Merchant Terms;
save or change a payment method;
turn automatic offsetting on or off, or change how offsets are settled;
rotate, reveal or remove your store’s connection keys, or disconnect your store;
agree to an over-allowance analysis charge.

5. Offset orders placed through the API

Account offsets. The API can quote offsets and build your own offset cart. It never charges you:
the checkout request returns a link, and you complete the purchase on our website.
Store orders (Embedded Offsetting). Posting a paid customer order to POST /v1/orders matches
its products to your store’s footprints and adds up their carbon. While automatic offsetting is off,
the answer is a preview and nothing is bought. While automatic offsetting is on, posting an order
buys the matched offsets and charges the payment method on your account, exactly as an order
delivered by your store plugin or app does.
Post only real, paid orders. Each order is identified by the order_ref you send; posting the same
order_ref again returns the first result and does not buy twice.
Prices are all-in. The price you are quoted is the price you pay.
Offset and removal purchases made through the API are subject to the “Carbon Offset and Removal
Purchases” section of the Terms of Service, including that purchases are non-refundable.

6. Your data and how we use it

What you send us (product details, page content, text and files) is used to produce your analysis,
which is stored in your account and returned to you through the API.
Your footprints are private unless you publish them. Every footprint starts private. A private
footprint is never shown to another user: not in their footprint searches, not on our website. If
you publish a footprint, other users can find it, with its product name and carbon figures. You can
make it private again at any time.
How analyses help each other. When we classify a product, we may use the industry classification
of a closely matching product we have analyzed before, from any account, and then calculate the
footprint afresh from reference data for the new product’s own country and price. This improves
classification for everyone. It never reveals another account’s product, footprint or data.
Page reading. When you send the HTML of a web page, we may use it to improve how we read pages
from that website.
We do not sell your data, and we do not use your customer orders, uploaded files or account details
for anything other than providing the service to you.

7. Retention

What	How long we keep it
Your analyses and footprints	Until you delete them
Uploaded files, and the enriched copy with carbon columns added	30 days, then deleted. The analysis itself is kept, and can be exported again
Exports you request	30 days, then deleted
The record of each catalog push	90 days
`Idempotency-Key` records	24 hours
Webhook endpoints and their delivery log	Until you delete the endpoint; the delivery log is deleted with it
Server and application logs, which record each request’s IP address, time, path and request ID	Kept for operating and securing the service

8. Webhooks

A webhook endpoint must be an https address on port 443 that resolves to a public internet
address. We refuse private, local and cloud-metadata addresses, and we check the address again
before every delivery.
Each delivery is signed. The signing secret is shown once, when you register the endpoint. Verify the
signature before trusting a delivery.
A delivery that does not receive a 2xx answer is retried, up to 15 attempts over about 24 hours. An
endpoint that fails 5 deliveries in a row is disabled. To resume deliveries, register the address
again as a new endpoint.
A webhook carries only data from your own account.

9. Fair use

Requests beyond the rate limit are refused with HTTP 429 and a Retry-After header. Wait and retry.
The “Acceptable Use” section of the Terms of Service applies to the API. In addition, do not:
share a key with anyone outside your organization; resell or sublicense access to the API; use the
API to copy CarbonGuru’s reference data in bulk or to build a competing dataset; work around rate
limits, scopes or plan limits; or load-test the API without our written permission.
We may suspend a key, or the API access of an account, that breaks these API Terms or endangers the
service or other users. Where we can, we will tell you first.

10. Changes to the API

The API is versioned under /v1/. We may add endpoints, fields and events to /v1/ at any time;
build your integration to ignore fields it does not recognize.

11. Estimates

Carbon footprints returned by the API are estimates. The “Carbon Offset and Removal Purchases” section
of the Terms of Service describes how they are made and their limits, and it applies to every figure
the API returns.

12. Ending API use

You can stop using the API at any time by revoking your keys and deleting your webhook endpoints.
Sections 5 (for orders already placed), 6, 7 and 11 continue to apply to data and purchases from
before that point.

13. Contact

Questions about these API Terms: the contact details in the Terms of Service.