Authentication
Every API call carries a single shared secret — your API key — in the request body. The key identifies the calling account, applies its rate-limit tier, and scopes every action to that account's data only.
Where to put the key
Pass the key as the key field in the form-encoded request body. Header-based auth is not supported — the v2 spec uses body params for compatibility with existing reseller SDKs.
Content-Type: application/x-www-form-urlencoded
key=YOUR_API_KEY&action=services
Generating and replacing keys
Keys are generated and revoked from /dashboard/api. The raw key is shown exactly once. The server retains a one-way verifier and a short non-secret identifier, so the raw value cannot be recovered later.
- Maximum 5 active keys per account. Old keys can be revoked individually.
- Replace without downtime. Create a replacement key, update your integration, then revoke the old key. Revoked keys are rejected on new requests.
- Active dashboard session required. Generation requires an authenticated, non-impersonated dashboard session. It does not add another email-code or password prompt.
What an API key can do
A v3 API key is limited to the documented actions and cannot access a logged-in dashboard session or unrelated account data.
- Withdraw or transfer balance.
- Change the account email, password, or 2FA settings.
- Generate or revoke other API keys through the API.
- Access admin or moderation endpoints.
Security recommendations
- Server-side only. Never embed an API key in a browser bundle, mobile app, or any client another party can decompile.
- Use environment variables. Don't commit keys to git.
.env files belong in .gitignore. - Revoke on suspicion. If a key is exposed in a log, screenshot, or shared chat, create a replacement and revoke the exposed key.
- Use webhooks to reduce polling where useful. Delivery is best-effort with retries, so keep handlers idempotent and reconcile important state with
action=status.