Authentication

Put the key after the word Bearer and one space. The API reads no other header, cookie or query parameter for keys.

Authorization: Bearer ip_live_...

curl https://api.inplan.io/v1/providers/1184617268 \  -H "Authorization: Bearer $INPLAN_KEY"

A key is ip_live_ followed by 40 letters and digits. The dashboard shows the start of each key so you can tell keys apart. We store only a hash of the full key, so we cannot show it again: copy it when you create it.

Call the API from your backend and keep the key in an environment variable or a secret store. Never put a key in browser or mobile app code, in a public repository, or in a URL. The API does not send CORS headers on /v1 endpoints, so browsers block direct calls from web pages.

If a key leaks, create a new key, switch your servers to it, then revoke the old one in the dashboard. A revoked key stops working within a minute.

A request without a valid key gets 401 with the type unauthorized and a WWW-Authenticate header. A missing header and an unknown or revoked key have different title values.

HTTP/1.1 401 UnauthorizedContent-Type: application/problem+json; charset=utf-8X-Request-Id: req_pctJoQwOrN-xK9WpWWW-Authenticate: Bearer realm="inplan"

{  "type": "unauthorized",  "title": "Missing API key",  "status": 401,  "detail": "Send `Authorization: Bearer ip_live_...`.",  "instance": "/v1/check",  "request_id": "req_pctJoQwOrN-xK9Wp",  "docs": "https://inplan.io/docs/errors#unauthorized"}

If the account behind a key is not active, the API answers 403 with the type account_suspended. Write to us if you see it: see Support.

GET /v1/status needs no key and does not count against any quota. Use it for health checks and to read the date of each data source. See Status.