Skip to navigation
Get started

Authentication

Every request carries an API key in the X-API-Key header.

View as Markdown
curl https://getoutprice.com/v1/dashboard/summary \
  -H "X-API-Key: pw_your_key_here"

Creating keys

Keys are created by a person signed in to the dashboard, with POST /v1/api-keys (in the API Reference). A key cannot create other keys, so if one leaks, revoking it is enough.

While signed in, open the browser’s developer console on the dashboard and run:

await (await fetch("/v1/api-keys?name=my-integration", { method: "POST" })).json()

Add &read_only=true for a read-only key. The key in the answer is the only time it is shown.

  • Full access keys can read and change everything the dashboard can, apart from signing in and account security.
  • Read-only keys can only read. Use them for reporting and dashboards; any request that would change something gets 403.

Only a hash of each key is stored, so a lost key cannot be shown again: revoke it and make a new one.

Keeping keys safe

An API key is a password for your account. Never put it in a web page, a mobile app or a public repository: anyone who can see it can use it.

  • Keep keys in environment variables or a secrets manager, not in code.
  • Use a separate, named key for each program, so you can revoke one alone.
  • Prefer read-only keys wherever writing is not needed.
  • Revoke keys you no longer use. The dashboard shows when each was last used.

When authentication fails

StatusMeaning
401No key was sent, or the key is wrong or revoked.
403The key is read-only and the request changes something, or the account’s plan does not include API access.

Repeated requests with wrong keys from one address are blocked for a while.