Authentication

Every APIVoid request is authenticated with an API key sent in the X-API-Key HTTP header.

Where to find your API key

Your API key is available in the APIVoid dashboard after you create an account, on the "API Keys" page, where you can create and manage your keys. A single key works across all API services available on your plan.

How to authenticate a request

Add the Content-Type and X-API-Key headers to your HTTPS POST request:

curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "93.174.95.106"}' 

The same header in PHP with cURL:

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/ip-reputation');
curl_setopt($curl, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-API-Key: ' . $apiKey
]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['ip' => '93.174.95.106']));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);

If the key is missing or invalid, the API returns a 4xx status with a JSON error field.

If the Content-Type header is not application/json, the API returns a 4xx status with a JSON error field.

See API Errors & Retries for additional details.

Keep your key secret

• Never expose the key client-side. Keep it out of browser JavaScript and mobile apps.
• Use your backend. Send API requests from your server to keep the key private.
• Store it in environment variables or a secrets manager, not in source code or public repositories.
• Rotate the key from the dashboard if you suspect it has been exposed.
• Monitor usage via the X-Service-Quota header or the dashboard to spot anomalies early.