Creating an API key: name, mode, permissions, validity, IP list and spending limit

The short answer: keys are created on the API page in My MozOut. You pick a name, the mode (Sandbox or Production), the permissions, the validity and, if you want, an IP list and a spending limit. You confirm with your password and a 6-digit code sent by e-mail. The key is shown only once: copy it straight away.

Who can create keys

The owner of an account with an active service or domain. Each account can have up to 20 keys, each with its own name. A key can never create another key: keys are only created on the API page.

What you choose

Field	What it is	Advice
Name	So you can recognise the key later.	Use the program's name, such as "company website" or "DNS script".
Mode	Sandbox (sandbox_) or Production (prod_).	Start in Sandbox. See Sandbox or Production.
Permissions	What the key may do, per area, with read and write kept apart.	Only what the program needs. See permissions by area.
Validity	30, 90 or 365 days, or no expiry. The default is 90 days.	The shorter it is, the less damage a leaked key can do.
IP list	Optional. If you fill it in, the key only works from those addresses.	Use it when the program runs on a server with a fixed IP.
Spending limit	The most the key may spend in 30 days, in the account currency.	Leave it at 0 if the key never needs to buy or pay. See the spending limit.

Step by step

1	Sign in to My MozOut and open the API page.

2	Name the key and choose the mode. To begin, choose Sandbox.

3	Tick the permissions and the validity and, where it makes sense, the IP list and the spending limit.

4	Confirm with your current password and the 6-digit code sent to your e-mail. The code is valid for 10 minutes and allows 5 attempts. If you sign in with Google or Facebook and have no usable password, the code alone is enough.

5	Copy the key and store it somewhere safe. Once it is created you also receive a notice by e-mail.

The key is shown only once. We keep only a digest of it (the hash) and its last 4 characters, so not even we can recover it. If you lose it, revoke it and create another.

How to use the key

The key starts with sandbox_ or prod_, followed by 43 random characters. It goes in every request, in the Authorization header. The API never accepts the key in the address and only answers over HTTPS. Keep it in an environment variable, outside your code:

export RLX_API_KEY="sandbox_..."
curl https://api.mozout.com/v1/token -H "Authorization: Bearer $RLX_API_KEY"

The answer from GET /v1/token confirms the key works and shows its mode, permissions, IP list, validity, the requests left this minute and the spending limit. The key itself never comes back in an answer. To call the API from PHP, see calling a web API with cURL.

The key belongs on a server, not in a browser. Browsers can only call the API from the documentation itself, so a page on your website cannot use the key directly: the request has to leave from your server. If you tried and got a CORS error, that is why: see the CORS error.

Ready to create your first key? Start with a Sandbox key, with only the permissions you need.

Create a key

Categories

Categories