API keys are created and managed in the dashboard. Live keys start with ips_live_ so secret scanners in GitHub and CI pipelines can detect accidental commits immediately.
# Three ways to send a key
Send the key in the Authorization header, the X-API-Key header, or the key query parameter. All three are accepted on every authenticated endpoint.
curl -sS https://api.ipscope.io/v1/ip/198.51.100.7 \
-H "Authorization: Bearer ips_live_••••••••"# Using keys with Official Server SDKs
All 8 official server SDKs accept an explicit apiKey / api_key parameter and automatically send Authorization: Bearer and X-API-Key headers on every request:
from ipscope import AsyncIpScopeClient
client = AsyncIpScopeClient(api_key=os.environ["IPSCOPE_KEY"])# Keeping keys on the server
# Rotating a key without downtime
- Create a second key in the dashboard (
Settings → API Keys). - Deploy the new key to your servers and verify traffic in the usage graph.
- Revoke the old key. Revocation takes effect globally within 30 seconds.
# When authentication fails
| Status | Code | Cause |
|---|---|---|
401 | missing_api_key | No key was sent on an endpoint that requires authentication. |
401 | invalid_api_key | The key does not exist or has been revoked. |
403 | forbidden_field_family | The request asked for a field family outside the key’s plan tier. |