Skip to main content
The Broker Panel API uses API keys. Send one API key with every request.

​
Send the API key

Send the key as a Bearer token in the Authorization header:
The API reads only this Bearer token for public API authentication. It does not read an X-API-Key header. The Bearer scheme must have an uppercase B and one space before the key. Header names are not case-sensitive.

​
Use the correct key type

​
Key state

Only a key with the active state can authenticate.
  • An inactive key returns the same authentication error as an invalid key.
  • An expired active key returns an expiration error.
  • Regeneration replaces the secret. The old secret stops working immediately.
  • Deletion removes the key. The deleted secret cannot authenticate.

​
Scope checks

Each endpoint requires one or more scopes. The admin:full scope satisfies every scope check. When an endpoint lists multiple scopes, the key needs any one of them. Forms, Settings, and scheduled-report scopes shown in API Center are reserved; no public v1 endpoint currently uses them. A missing scope returns HTTP 403 with the insufficient_permissions error code.

​
Verify API access

Use Verify API Access to choose the correct check and follow the recommended verification sequence.
  • GET /v1/auth-check verifies general authentication without requiring a feature scope.
  • POST /v1/auth-check verifies services:write or admin:full access without creating a service.

​
Troubleshooting

See Errors and Retries for authentication and permission failures, and IP Firewall for network restrictions.
Last modified on September 8, 2026