API keys
Test and live API keys, how to rotate them, and how to restrict a key to your server's IP addresses.
Every API request needs an Authorization: Bearer <API key> header. Create API keys under API keys in the Dashboard.
| Prefix | Mode | Reaches operators |
|---|---|---|
sk_test_ | Test | No |
sk_live_ | Live | Yes |
The API key's mode decides the mode of every response, webhook, session and rule. You accept the e-contract when you sign up.
curl https://api.2fa.mn/v1/webhook \
-H "Authorization: Bearer $TWOFA_KEY"Server-side only
Never put a secret API key (sk_) in a browser, a mobile app or git. Keep it in an environment variable such as TWOFA_KEY.
Rotate an API key
A revoked API key stops working immediately. To rotate without downtime:
Create a new API key
Create a new API key under API keys in the Dashboard.
Deploy the new API key
Deploy the new API key to your servers.
Revoke the old API key
Revoke the old API key.
If you think an API key has leaked, revoke it right away.
Restrict by IP
An API key can be limited to specific IP addresses or CIDR ranges (for example 203.0.113.10 or 203.0.113.0/24). Requests from any other address get 401 unauthorized. An empty list allows any address. The restriction is set per API key: under API keys in the Dashboard, add your addresses in the key's IP restriction field. Each test and live API key has its own list.
Webhook secret
The webhook secret is separate from your API keys, one per mode. Rotate it with POST /v1/webhook/rotate-secret. See Webhooks & signatures.
What's next
Was this page helpful?