Skip to content
IRONDOME
Docs menu

Start here

Authentication

Authenticate IronDome API requests with a Bearer key. Create, store and revoke server-side keys, and keep credentials out of browser code.

On this page

Authenticate requests to https://api.irondome.dev with the full API key issued by your IronDome account.

Create and store a key

Open API keys, create a key, and copy it when shown. Store it in your server's secret manager or an ignored environment file as IRONDOME_API_KEY.

Treat credentials as opaque. Do not construct them, change their prefixes, or infer permissions from their appearance. Manage access through your account.

Plan changes

New keys use the unified account-key format. Keep the same key and https://api.irondome.dev when upgrading or downgrading your plan. The server applies the account's current plan after policy publication; a plan change does not require recreating your SDK client.

Rotate a key when replacing a credential, not for an ordinary plan change. Existing legacy keys need a one-time replacement; see migration.

Send the credential

HTTP
Authorization: Bearer YOUR_API_KEY

Use this header on /v1/check, /v1/check/bulk, and /v1/usage. The health endpoint needs no credential. Do not send keys in query strings or request bodies.

The service checks credentials, permissions, and account policy. HTTP 401 means authentication failed; HTTP 403 means the operation is not permitted. See errors.

Rotate a key

  1. Create a replacement in the dashboard and save it securely.
  2. Update every server or deployment environment using the credential.
  3. Recreate long-lived clients so they read the replacement. Drain in-flight work before closing their pools.
  4. Confirm a controlled check succeeds. This check consumes usage.
  5. Revoke the replaced key and check its dashboard status.

Revocation can remain pending during policy publication. Do not assume immediate global revocation. Revoke an exposed key promptly and replace it wherever it was deployed.

Browser and platform applications

Your browser should call your own protected backend. Validate inputs and apply rate limits before calling IronDome. An unrestricted proxy can consume your allowance.

Keep credentials out of browser bundles, frontend environment variables, analytics, and logs. A Supabase installation uses a separate hook signing secret; do not put an API key in the hook secret field.