IPRout
LoginSign up

API Key Authentication

Authenticate every IPRout API request with your secret API key. The recommended header is Authorization: Bearer YOUR_API_KEY. X-API-Key is also supported. Store keys in server-side environment variables, never commit them, and never embed a live secret in browser JavaScript.

Last updated August 10, 2026

How do I send a Bearer token?

Bearer authentication works consistently across HTTP clients and is the recommended form.

curl -H "Authorization: Bearer YOUR_API_KEY" https://api.iprout.com/ip

Can I use X-API-Key?

Yes. Use the alternative header when it better fits your gateway or HTTP client.

curl -H "X-API-Key: YOUR_API_KEY" https://api.iprout.com/ip

How should keys be stored?

Read keys from a secret manager or server environment. Rotate a key immediately if it appears in source control, logs, screenshots, or frontend bundles.

  • Use separate named keys for separate services
  • Apply CORS restrictions to browser-facing integrations
  • Revoke old keys after rotation