Authentication
How to authenticate IGramAPI requests with an API key: the Bearer header, the X-API-Key alternative, managing keys, and what happens when a key is wrong.
All data endpoints use an API key. There is no OAuth flow and nobody you look up has to log in.
Sending the key
Use the standard Authorization header:
Authorization: Bearer igk_your_key_hereThe X-API-Key header is also accepted if your HTTP client makes Bearer tokens awkward:
X-API-Key: igk_your_key_hereSend keys only over HTTPS, in headers. Do not put them in URLs or query strings, where they end up in logs.
Managing keys
In the dashboard you can:
- create several keys (the number depends on your plan), for example one per environment or customer;
- see when each key was last used;
- rotate a key, which revokes it and creates a new one with the same name;
- revoke a key, which takes effect immediately.
All keys on an account share the same credits and rate limit.
Authentication errors
| Status | code |
Meaning |
|---|---|---|
| 401 | missing_api_key |
No key was sent. |
| 401 | invalid_api_key |
The key is wrong, revoked or expired. |
| 403 | plan_upgrade_required |
The key is valid, but the endpoint needs a paid plan. |
| 429 | rate_limit_exceeded |
Too many requests, or too many invalid keys from your address. |
Repeated invalid keys from one address are slowed down automatically, so make sure a misconfigured job does not retry in a tight loop.
Good practice
- Keep keys on the server and load them from environment variables.
- Use a separate key for each application, so one leak does not force you to change everything.
- Rotate keys when people leave your team.
- Never commit a key to a repository. If you did, revoke it.
Something unclear or missing? Tell us and we will fix the page.