Authentication

Requests need an API key in the Authorization header, as a bearer token:

GET /v1/ip/8.8.8.8 HTTP/1.1
Host: api.ipalmanac.com
Authorization: Bearer <your API key>

A few calls need no key: GET /health, the OpenAPI spec at /v1/openapi.json, and listing the MCP server's tools.

Create a keyCopy Anchor Link

Keys are made in the console, under a project's API keys.

• Label: required, so you can tell keys apart later (for example "Production server").
• Expiry: optional. A key never expires unless you set a date.
• Shown once: copy the key when it appears. Afterwards the console shows only its first and last characters.
• Confirm it's you: if you signed in more than ten minutes ago, the console first asks for a code we email you (or your authenticator app's code, if you turned two-factor sign-in on).

Workspace owners and admins can create and revoke keys; members can see them and their usage. A workspace can have at most 25 active keys. Revoked and expired keys don't count.

The console's Playground page makes its own key in the project the first time someone runs a request there. It is labeled Playground, never leaves the console, and counts toward the 25 like any other key. It expires after 90 days and is replaced on the next run; you can revoke it from the keys list.

Keep keys secretCopy Anchor Link

A key starts with sk_. Treat it like a password:

• Never put it in a URL. A request with a key in a query parameter (api_key, apikey, key, token or authorization) is refused with 401, so the key doesn't end up in logs and browser history.
• Call the API from your server, not a web page. The API accepts browser requests only from the console, and a key in front-end code is public.
• Use one key per app or environment, so you can revoke one without breaking the others.

Rotate or revoke a keyCopy Anchor Link

To rotate, create a new key, deploy it, then revoke the old one. Revoking takes effect immediately and can't be undone.

When a key is refusedCopy Anchor Link

The key is checked before the parameters, so a bad key gets 401 even when the request has other problems. See Errors.

Projects and workspacesCopy Anchor Link

A key belongs to one project, and a project belongs to a workspace. All keys in a workspace share its plan's monthly quota and per-minute rate. A project can also have its own monthly cap, set in its settings, to stop one app from using the whole workspace's quota. See Rate limits and quotas.