API guide
AuthenticationAPI keys are organisation-bound bearer credentials with explicit scopes and optional source-address restrictions.
Interactive referenceSource repository
Bearer authentication
HTTP
Authorization: Bearer as213905_…
The API deliberately rejects credentials in query parameters because URLs are copied into access logs, browser history and Referer headers.
ScopesA key has exactly the permissions selected when it is created. Read and write permissions are separate.
ParameterInTypeDescription
organizations:readscopepermissionRead the organisation bound to the key.
invoices:readscopepermissionList billing documents and payment state.
services:readscopepermissionRead services and BGP VM metrics.
services:writescopepermissionStart, stop or restart controllable services.
traffic:readscopepermissionRead organisation and per-tunnel traffic.
tunnels:readscopepermissionList transit tunnels.
tunnels:writescopepermissionCreate or remove transit tunnels.
geofeeds:readscopepermissionRead geofeeds and records.
geofeeds:writescopepermissionCreate, edit, rotate and delete geofeeds.
Organisation headerGeofeed endpoints require the organisation UUID explicitly. The key still cannot access another organisation.
HTTP
X-Organization-ID: 9f44e0e7-13d4-4af3-bc6e-76b91c93b752
Rotation and revocation
Recommended rotation
Create the replacement key, deploy it, verify successful calls, then revoke the previous key. A revoked or unknown key returns the same generic error to avoid credential enumeration.