Iian

Documentation / Authentication

Keep your key private.

Every API request must include an API key. Keys identify your account and should be treated like passwords.

Send a bearer key

Include the key in the HTTP Authorization header using the Bearer scheme.

Authorization: Bearer YOUR_API_KEY

Do not place keys in browser code, public repositories, URLs, or client-side applications. Keep them in a server-side secret store and send requests from your own service.

Get a key

API keys are issued when access is approved. Request access if you do not have an account yet. The dashboard shows the key once when it is created; save it securely at that time.

Rotate a key

Create a replacement key in the dashboard, update the services that use the old key, then revoke the old key. If you think a key was exposed, revoke it immediately and issue another. Requests using a revoked key are rejected.

Missing or invalid key

A request with no Authorization header, an invalid key, or a revoked key returns HTTP 401 with this JSON body:

{
  "error": {
    "code": "unauthorized",
    "message": "A valid API key is required."
  }
}

Check that the header uses the exact Bearer scheme and that the key has not been revoked. Do not retry unchanged credentials.