Getting started

Authentication

Requests are authenticated with an API key. There is nothing else to configure.

Sending your key

Send the key in the x-api-key header. The standard Authorization: Bearer header is also accepted.

Either works

curl "https://api.autoparse.io/v1/vin/decode/2G1FK1EJ6A9133857" \
  -H "x-api-key: ap_live_xxxxxxxxxxxxxxxx"

curl "https://api.autoparse.io/v1/vin/decode/2G1FK1EJ6A9133857" \
  -H "Authorization: Bearer ap_live_xxxxxxxxxxxxxxxx"

Managing keys

Create up to 10 active keys per account, for example one per environment or service.
Keys are shown once at creation. We store only a one-way hash, so we cannot recover a lost key. Create a new one and revoke the old.
Revoking a key takes effect within seconds. Requests with it return 401 invalid_api_key.
Usage logs show which key made each request.

Keep keys secret

Treat keys like passwords. Load them from environment variables or a secret manager, never commit them to source control, and never ship them in browser or mobile code. If a key leaks, revoke it in the console immediately.