# API keys and security

How to send your key, use more than one key and allow only your servers.

## Your key

Every request carries the API key from your account page: clientKey in JSON requests, key in in.php and res.php. A key is 32 characters (0-9, a-f). Keep it on your server; anyone with the key can spend your balance.

```json
{
  "clientKey": "YOUR_API_KEY"
}
```

## More keys

You can make up to 5 extra keys on the account page, for example one per server or project. They share the balance, show when they were last used and can be turned off one by one.

## IP allow list

Add up to 20 IP addresses on the account page and only those addresses can use your keys. Requests from other addresses get ERROR_IP_NOT_ALLOWED and are not charged.

## Calls from a browser

in.php and res.php add the CORS header Access-Control-Allow-Origin: * when you send header_acao=1. Calling the API from a public web page exposes your key, so use this only for your own tools.