Skip to main content
Every request carries an API key as a Bearer token.

​
Getting a key

  1. Sign in to IOTools.cloud
  2. Go to Account → API keys
  3. Create key, give it a name you’ll recognise later
  4. Copy it
The full key is shown once, at creation. Copy it before closing the dialog — you can always revoke it and mint another.
You can hold up to 10 active keys at a time. Name them per environment or per integration, so revoking one affects only that integration.

​
Key format

Every key starts with iot_live_. That is the only kind — there is no separate test key or sandbox.
For testing, point at a zero-weight tool such as case-converter or base64-decode — you will be charged your plan’s minimum per call — and read credits_remaining on the response to see what you spent.

​
Storing it

Read it from your environment at request time — never hard-code it in source. Keys belong on your server. A key in client-side JavaScript is readable by anyone, who can then spend your credits. To use a tool from a browser, proxy the request through your own backend.

​
Revoking

Account → API keys → Revoke. It takes effect on the next request; there is no cache to wait out. Revoked keys stay in the list rather than disappearing, so you keep the record.

​
Auth errors

Every failure is an RFC 9457 problem document.