API key security

Keys look like qv_<prefix>_<secret> and are shown exactly once at creation — only a hash is stored. This page is the operational side: scoping a key to your infrastructure, rotating it, and containing a leak.

IP allowlists

Every key supports an IP allowlist: a per-key list of up to 32 CIDR ranges (bare IPs count as /32), edited on the console API keys page. With an allowlist set, requests from any other address are rejected fail-closed with 403 ip-not-allowed — a leaked key is unusable from any address you have not listed. Allowlist edits take effect immediately (60 seconds worst case).

Rotation

Rotating a key (also on the API keys page) mints a replacement with the same name, allowlist and expiry, and lets you pick a grace window: 24 hours, during which both keys work while you roll out the new secret, or none, killing the old key at once.

If a key leaks

Rotate it with no grace window — or revoke it outright if nothing depends on it. Revocations and rotations are effective within 60 seconds at most. If you cannot tell where the key was used from, tightening its IP allowlist is an immediate containment step.

Related

• API quickstart — creating your first key and making your first call.
• The validation call — the error table, including the key-related 401/403 problems.
• Pricing — the rate limits and quotas each key inherits from its plan.