Help Center / api

Managing API keys

API keys authenticate your applications with our API. Learn how to create and manage them securely.

Creating an API Key

1. Go to Settings > API Keys
2. Click Create New Key
3. Enter a descriptive name
4. Select permissions:
   • Read - View resources only
   • Write - Create and modify resources
   • Delete - Remove resources
5. Set IP restrictions (optional but recommended)
6. Click Create
7. Copy the key immediately - it won't be shown again!

Key Format

API keys look like this:

osir_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6

Parts:

• osir_ - Prefix identifying our API
• live_ or test_ - Environment
• Random string - Unique identifier

Using Your API Key

In Headers (Recommended)

curl -H "Authorization: Bearer osir_live_xxx" \
  https://api.osir.com/v1/domains

In Query String (Not Recommended)

https://api.osir.com/v1/domains?api_key=osir_live_xxx

Test vs Live Keys

Always use test keys during development!

IP Restrictions

Limit key usage to specific IPs:

1. Edit your API key
2. Add allowed IP addresses
3. Save changes

Example:

• 192.168.1.100 - Single IP
• 192.168.1.0/24 - IP range

Key Permissions

Revoking Keys

If a key is compromised:

1. Go to API Keys
2. Find the key
3. Click Revoke
4. Key is immediately invalidated

Best Practices

• One key per application - Easier to revoke if needed
• Use IP restrictions - Limit exposure
• Rotate regularly - Create new keys, revoke old ones
• Never commit keys - Use environment variables
• Monitor usage - Check API logs for unusual activity

Environment Variables

Store keys securely:

# .env file (never commit!)
OSIR_API_KEY=osir_live_xxx

// Use in code
const apiKey = process.env.OSIR_API_KEY