Skip to main contentSkip to search
Skip to main content

API Authentication

Secure your IronWiFi REST API requests with Bearer token authentication. All API endpoints require a valid API key passed in the Authorization header to authenticate and authorize programmatic access to your IronWiFi account resources.

Generating an API Key​

  1. Log into the IronWiFi Console
  2. Navigate to Account > API Keys
  3. Click Generate New Key
  4. Copy the key immediately
warning

The API key is only displayed once upon generation. Store it securely. If lost, generate a new key.

Using the API Key​

Include the API key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Example with cURL​

Example with PHP​

Example with JavaScript​

Example with Python​

Required Headers​

HeaderValueRequired
AuthorizationBearer YOUR_API_KEYYes
Content-Typeapplication/json;charset=utf-8For POST/PUT

API Key Security​

Best Practices​

  1. Never expose in client-side code - Only use server-side
  2. Use environment variables - Don't hardcode in source
  3. Rotate regularly - Generate new keys periodically
  4. Limit scope - Use separate keys for different purposes
  5. Monitor usage - Watch for unusual activity

Storing Keys Securely​

Environment Variables:

Configuration Files:

Secret Management:

  • AWS Secrets Manager
  • HashiCorp Vault
  • Azure Key Vault

Managing API Keys​

Viewing Active Keys​

  1. Navigate to Account > API Keys
  2. View list of active keys (masked)
  3. See creation date and last used

Revoking Keys​

  1. Navigate to Account > API Keys
  2. Click Revoke next to the key
  3. Confirm revocation
note

Revoking a key immediately invalidates it. Any systems using that key will stop working.

Key Rotation​

Recommended rotation schedule:

  1. Generate new key
  2. Update all systems using the old key
  3. Test functionality
  4. Revoke old key

Troubleshooting​

401 Unauthorized​

Causes:

  • Invalid or revoked API key
  • Missing Authorization header
  • Wrong header format

Solutions:

  • Verify key is correct
  • Check header: 
    Authorization: Bearer KEY
  • Generate new key if needed

403 Forbidden​

Causes:

  • Key doesn't have required permissions
  • IP restrictions (if configured)

Solutions:

  • Check key permissions
  • Verify source IP is allowed

Was this page helpful?