API key settings

Each key has three settings that the API enforces on every request. Change them in Settings > API by editing the key. Changes apply to the next request.

Active

A key that is switched off is refused with 403:

{ "status": false, "error": { "message": "This API key is disabled." } }

Switch it back on to resume. Use this to pause an integration without losing its key. Deleting a key stops it at once (401).

Allowed IPs

When the list is not empty, only requests from those addresses are accepted. Each entry is a single address (203.0.113.7) or a CIDR range (203.0.113.0/24). Any other address gets 403:

{ "status": false, "error": { "message": "This IP address is not allowed for this API key." } }

Leave the list empty to allow any address. If your integration runs behind a NAT or a cloud egress, add the public address the API sees, not your private one.

Max calls per day

The number of requests the key may make per day, counted per UTC day (midnight to midnight UTC). Every response to a key carries:

Header	Meaning
X-RateLimit-Limit	The key’s daily limit.
X-RateLimit-Remaining	Calls left today.

When the key reaches the limit, further requests answer 429 until UTC midnight:

{ "status": false, "error": { "message": "Daily API call limit reached for this API key." } }

The 429 also carries Retry-After, the number of seconds until UTC midnight. Raise the limit in the key settings if your normal traffic needs more.

Per-minute limit

Independently of the daily limit, each key can make up to 300 requests per minute. Above that the API answers 429 with a Retry-After header. Spread bulk work over time, and back off when you see 429. On key requests the X-RateLimit-* headers describe the daily limit, not the per-minute one.

Response shape

All of these refusals use the normal error shape:

{ "status": false, "error": { "message": "..." } }

Read the HTTP status, not the message text. Messages can be reworded.