API Reference

Authentication & API Keys

Authenticate every request with your service API key, sent as a header.

The header

Send your key in the X-API-Key header. Keys look like pk_live_xxxxxxxxxxxx:

GET /api/v1/keys/api/blacklist
Host: api.pandauth.com
X-API-Key: pk_live_xxxxxxxxxxxx

No bearer token

Authentication is a direct header. There's no OAuth or bearer flow. Just set X-API-Key on each request.

Where to find your key

Open Service Settings → General → API Key. There's a copy icon, and a regenerate button that invalidates the old key immediately if it's ever leaked.

One key for every service

Your account also has a General API key (it starts with panda_) in Settings → Account. It works on these same endpoints when you add an X-Service-Id header, and it also signs in to the dashboard and reaches Vault V3. See the General API Key page.

Keep it secret

Server-side only

Treat the API key like a password. Use it from your backend or bot, not from client code where users could read it.