HTTP Tweak
Every Client or Business API request needs the matching account's API key. A configuration's unique key identifies a resource; it does not authenticate the request.
Create the right credential
| API | Get a key | Scope |
|---|---|---|
| Client | Client API account | Manage configurations owned by your panel account |
| Business | Business API account | Generate importable configurations under your account |
The full credential is displayed once when created or rotated. The panel stores its hash and a masked preview. If you lose the full key, rotate it and update your integration.
Send the key in a header
The recommended header on this installation is X-API-Key:
X-API-Key: YOUR_CLIENT_API_KEY
Accept: application/json
Content-Type: application/json
For Business requests, substitute your Business API key. Content-Type is needed when sending a JSON body.
You can alternatively send:
Authorization: Bearer YOUR_CLIENT_API_KEY
When both headers are present, X-API-Key takes precedence. Credentials in a query string or request body are not accepted. Do not put these keys in a mobile app, browser bundle, public repository, or share link.
Rotate or revoke
Rotate a key in the corresponding account page, then replace the secret in your backend. The old credential stops working. Revoke it to stop access. Rotation does not reset your daily usage.
An inactive key or owner cannot use the API. Business accounts can also be suspended by an administrator; rotating a key does not bypass a suspension.
Ownership and IDs
Client API calls are restricted to the account that owns the configuration. A different owner's configuration returns 403; a missing configuration returns 404.
| Value | Where to get it | Where to use it |
|---|---|---|
Configuration unique_key |
GET /api/v1/configs |
{config_key} in resource and batch-sync URLs |
Server or tweak unique_key |
Resource list or creation response | {server_key} / {tweak_key} in URLs |
Password or device row id |
Access list or creation response | {password_id} / {device_id} in access URLs |
| Device hardware identifier | The user's app | The device_ids creation array; it is not the numeric row ID |
Copy keys exactly as returned. Never substitute database IDs for a resource unique key.
Platform and language
Client API calls normally do not need a platform header. When you send X-Platform, use android or ios; if a platform body/query value is also present, the two values must match.
Send Accept: application/json so validation failures are returned as JSON. Treat HTTP status, success, and structured error fields as the contract rather than comparing human-readable messages, which may be localized.
The mobile API uses signed device requests and a different authentication flow. A Client or Business API key cannot replace that flow.