# API key settings

Each key has three settings that the API enforces on every request. Change them in **Settings > API** by editing
the key. Changes apply to the next request.

## Active

A key that is switched off is refused with `403`:

```json
{ "status": false, "error": { "message": "This API key is disabled." } }
```

Switch it back on to resume. Use this to pause an integration without losing its key. Deleting a key stops it at once
(`401`).

## Allowed IPs

When the list is not empty, only requests from those addresses are accepted. Each entry is a single address
(`203.0.113.7`) or a CIDR range (`203.0.113.0/24`). Any other address gets `403`:

```json
{ "status": false, "error": { "message": "This IP address is not allowed for this API key." } }
```

Leave the list empty to allow any address. If your integration runs behind a NAT or a cloud egress, add the public
address the API sees, not your private one.

## Max calls per day

The number of requests the key may make per day, counted per UTC day (midnight to midnight UTC). Every response to a
key carries:

| Header | Meaning |
| --- | --- |
| `X-RateLimit-Limit` | The key's daily limit. |
| `X-RateLimit-Remaining` | Calls left today. |

When the key reaches the limit, further requests answer `429` until UTC midnight:

```json
{ "status": false, "error": { "message": "Daily API call limit reached for this API key." } }
```

The `429` also carries `Retry-After`, the number of seconds until UTC midnight. Raise the limit in the key settings
if your normal traffic needs more.

## Per-minute limit

Independently of the daily limit, each key can make up to **300 requests per minute**. Above that the API answers
`429` with a `Retry-After` header. Spread bulk work over time, and back off when you see `429`. On key requests the
`X-RateLimit-*` headers describe the daily limit, not the per-minute one.

## Response shape

All of these refusals use the normal [error shape](/concepts/errors/):

```json
{ "status": false, "error": { "message": "..." } }
```

Read the HTTP status, not the message text. Messages can be reworded.