Authentication

Pass the key as the key field in the form-encoded request body. Header-based auth is not supported — the v2 spec uses body params for compatibility with existing reseller SDKs.

Content-Type: application/x-www-form-urlencoded

key=YOUR_API_KEY&action=services

Send a POST with either form fields (application/x-www-form-urlencoded) or a JSON object with the same flat names. The body can be at most 32 KB. Unknown parameters are ignored, and an empty value counts as absent. Any other method is refused with METHOD_NOT_ALLOWED.

The key, the account and the API switch are checked fresh on every call, so a suspended account or a revoked key stops working at once. The account must be active and its email address verified.

• 401

  INVALID_KEY

  Invalid API key

  The key is missing, wrong or revoked. Fix the request first.

• 403

  INACTIVE_ACCOUNT

  Account suspended

  The account is suspended. Fix the request first.

• 403

  EMAIL_UNVERIFIED

  Email verification required

  The email address of the account is not verified yet. Fix the request first.

• 503

  API_DISABLED

  The API is temporarily disabled

  The API is switched off for a short time. Retry-After says when to try again. Retrying can help.

• 405

  METHOD_NOT_ALLOWED

  Use POST

  The request was not a POST. Fix the request first.

• 413

  BODY_TOO_LARGE

  Request body too large

  The request body is too large. Fix the request first.

key=YOUR_API_KEY&action=balance

{
  "error": "Invalid API key",
  "error_code": "INVALID_KEY",
  "retryable": false
}

Keys are generated and revoked from /dashboard/api. The raw key is shown exactly once. The server retains a one-way verifier and a short non-secret identifier, so the raw value cannot be recovered later.

1. 1

   Maximum 5 active keys

   per account. Old keys can be revoked individually.
2. 2

   Replace without downtime.

   Create a replacement key, update your integration, then revoke the old key. Revoked keys are rejected on new requests.
3. 3

   Active dashboard session required.

   Generation requires an authenticated, non-impersonated dashboard session. It does not add another email-code or password prompt.

A v3 API key is limited to the documented actions and cannot access a logged-in dashboard session or unrelated account data.

• Withdraw or transfer balance.
• Change the account email, password, or 2FA settings.
• Generate or revoke other API keys through the API.
• Access admin or moderation endpoints.