# Authentication

Send your key in the `Authorization` header of every request, as a bearer token. Only `/v1/status` works without a key.

Source: https://inplan.io/docs/authentication · Updated 2026-10-30

## The Authorization header

Put the key after the word `Bearer` and one space. The API reads no other header, cookie or query parameter for keys.

```text
Authorization: Bearer ip_live_...
```

curl:

```bash
curl https://api.inplan.io/v1/providers/1184617268 \
  -H "Authorization: Bearer $INPLAN_KEY"
```

JavaScript:

```javascript
const res = await fetch("https://api.inplan.io/v1/providers/1184617268", {
  headers: { Authorization: `Bearer ${process.env.INPLAN_KEY}` },
});
const body = await res.json();
console.log(body.data.name.display);
```

Python:

```python
import os, requests

res = requests.get(
    "https://api.inplan.io/v1/providers/1184617268",
    headers={"Authorization": f"Bearer {os.environ['INPLAN_KEY']}"},
    timeout=10,
)
body = res.json()
print(body["data"]["name"]["display"])
```

## Key format

A key is `ip_live_` followed by 40 letters and digits. The dashboard shows the start of each key so you can tell keys apart. We store only a hash of the full key, so we cannot show it again: copy it when you create it.

## Keep keys on your server

Call the API from your backend and keep the key in an environment variable or a secret store. Never put a key in browser or mobile app code, in a public repository, or in a URL. The API does not send CORS headers on `/v1` endpoints, so browsers block direct calls from web pages.

If a key leaks, create a new key, switch your servers to it, then revoke the old one in the dashboard. A revoked key stops working within a minute.

## When the key is missing or wrong

A request without a valid key gets `401` with the type `unauthorized` and a `WWW-Authenticate` header. A missing header and an unknown or revoked key have different `title` values.

Response (401 Unauthorized · application/problem+json):

```http
HTTP/1.1 401 Unauthorized
Content-Type: application/problem+json; charset=utf-8
X-Request-Id: req_pctJoQwOrN-xK9Wp
WWW-Authenticate: Bearer realm="inplan"
```

```json
{
  "type": "unauthorized",
  "title": "Missing API key",
  "status": 401,
  "detail": "Send `Authorization: Bearer ip_live_...`.",
  "instance": "/v1/check",
  "request_id": "req_pctJoQwOrN-xK9Wp",
  "docs": "https://inplan.io/docs/errors#unauthorized"
}
```

If the account behind a key is not active, the API answers `403` with the type `account_suspended`. Write to us if you see it: see [Support](https://inplan.io/docs/support).

## Endpoints without a key

`GET /v1/status` needs no key and does not count against any quota. Use it for health checks and to read the date of each data source. See [Status](https://inplan.io/docs/api/status).