Authentication

All /open-api/v1/** business APIs use API key authentication. API keys are scoped to the current account and cannot be created through these business APIs.

Get an API key

Sign in to the IPFBS Dashboard. If the API Key management feature is available for this instance, open its API Key page from the Dashboard menu, create a key, and securely save its complete value when it is shown. If the page is unavailable, contact the instance operator to enable or provision API access.

Use the API key issued for this instance with its own public API origin. Do not reuse keys across instances or environments.

Permission scope

An API key accesses the account's enabled Open API capabilities, not Dashboard APIs. Keep it as a high-privilege credential. The IP whitelist, when enabled, is shared by the account's API keys; it is not configured per key. Business limits such as wallet balance and inventory still apply.

Request header

Send exactly one X-API-Key header with every request:

X-API-Key: <YOUR_API_KEY>

Never put the key in a URL, request body, cookie, or browser code.

Authentication failures

When the Open API handles an authentication failure normally, it returns HTTP 200 with business code: 400001:

{"code":400001,"msg":"Authentication failed.","data":null,"next":null}

Check the key state, expiration, and account-wide IP whitelist in the Dashboard or with the instance operator. Do not log the complete key; revoke and replace it if exposure is suspected.