Skip to main content
Every request carries an API key as a Bearer token.

​
Getting a key

  1. Sign in to IOTools.cloud
  2. Go to Account → API keys
  3. Create key, give it a name you’ll recognise later
  4. Copy it
The full key is shown once, at creation. We store only a hash, so we cannot show it to you again or recover it. Revoke and mint a new one if you lose it.
You can hold up to 10 active keys at a time. Name them per environment or per integration, so revoking one affects only that integration.

​
Key format

For testing, point at a zero-weight tool such as case-converter or base64-decode — you will be charged your plan’s minimum per call — and read credits_remaining on the response to see what you spent.

​
Storing it

Keys belong on your server. A key in client-side JavaScript is readable by anyone, who can then spend your credits. To use a tool from a browser, proxy the request through your own backend.

​
Revoking

Account → API keys → Revoke. It takes effect on the next request; there is no cache to wait out. Revoked keys stay in the list rather than disappearing, so you keep the record.

​
Auth errors

Every failure is an RFC 9457 problem document.