API Keys
API keys authenticate your requests to the BIN Lookup API. Each key is scoped to an organisation and passed as a Bearer token in the Authorization header.
Creating a Key
- Go to API Keys in your organisation dashboard.
- Click Create Key. Keys are named automatically — rename them inline at any time (e.g. “Production”, “Staging”).
The full API key is displayed once immediately after creation, together with a ready-to-run cURL command with the key pre-filled — copy it to make your first lookup straight away. Store the key somewhere secure; you won’t be able to view it again.
Creating, renaming, and revoking keys requires the Owner or Developer role — see Team Roles.
Using Your Key
Include your API key in the Authorization header using the Bearer scheme:
curl -X POST "https://api.binlookupapi.com/v1/bin" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"number": 42467101}'Managing Keys
The API Keys page lists all keys for your organisation. Each entry shows:
| Column | Description |
|---|---|
| Name | The label you gave the key, if any |
| Key | A prefix of the key (e.g. blapi_live_abc1...) for identification |
| Created | Date the key was created |
| Status | active, revoked, or expired |
The full key is never displayed after creation. Use the prefix to identify which key is which.
Revoking a Key
To revoke a key, click Revoke next to it in the table and confirm the prompt. Revocation is immediate and permanent — the key stops working right away and cannot be reactivated.
If you need to replace a revoked key, create a new one.
Security Best Practices
- Copy once, store securely. The key is shown only at creation. Use a secrets manager or environment variable — not source control.
- Use separate keys per environment. Create distinct keys for development, staging, and production so you can revoke one without affecting the others.
- Revoke unused keys. If a key is no longer needed, revoke it. There’s no cost to creating new ones.
- Don’t share keys. Each team member or service that needs access should use their own key.
Error Responses
Invalid or missing authentication will return a 401 error:
{
"error": "UNAUTHORIZED",
"message": "Missing, invalid, revoked, or expired API key"
}