API Authentication

Overview

The MeasureLLM API uses API keys for authentication. All API requests must include a valid API key in the Authorization header.

Getting Your API Key

Create an API Key

1. Log in to your MeasureLLM account
2. Go to Settings → API Keys
3. Click "Create New API Key"
4. Enter a name for the key (e.g., "Production" or "Development")
5. Click "Create"
6. Copy and securely store the key (it won't be shown again)

Using Your API Key

Authorization Header

Include your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer YOUR_API_KEY

Example Request

curl -X GET "https://api.measurellm.com/api/v1/keywords" \
  -H "Authorization: Bearer mlm_live_abc123xyz789" \
  -H "Content-Type: application/json"

JavaScript/Node.js

const response = await fetch('https://api.measurellm.com/api/v1/keywords', {
  headers: {
    'Authorization': 'Bearer ' + process.env.MEASURELLM_API_KEY,
    'Content-Type': 'application/json'
  }
});

Python

import requests
import os

response = requests.get(
    'https://api.measurellm.com/api/v1/keywords',
    headers={
        'Authorization': f'Bearer {os.environ["MEASURELLM_API_KEY"]}',
        'Content-Type': 'application/json'
    }
)

API Key Types

API Key Security

Environment Variables

Store your API key in an environment variable:

# .env file (never commit this!)
MEASURELLM_API_KEY=mlm_live_abc123xyz789

.gitignore

Ensure your environment file is excluded from version control:

# .gitignore
.env
.env.local
.env.production

Advanced Security Features

MeasureLLM provides additional security features to protect your API keys and restrict access to authorized sources only.

IP Whitelisting

Domain Whitelisting

Note: Domain whitelisting works for browser-based requests that include Origin headers. For server-to-server integrations, use IP whitelisting instead.

Managing API Keys

View Keys

See all your API keys in Settings → API Keys. You can view:

• Key name
• Key prefix (for identification)
• Created date
• Last used date
• Status (active/revoked)

Rotate Keys

Revoke Keys

If a key is compromised or no longer needed:

1. Go to Settings → API Keys
2. Find the key to revoke
3. Click "Revoke"
4. Confirm the action

Revoked keys immediately stop working. This action cannot be undone.

Error Responses

401 Unauthorized

Returned when authentication fails:

{
  "detail": "Invalid or missing API key"
}

403 Forbidden (Security Restrictions)

Returned when your request violates security restrictions:

// IP not in whitelist
{
  "detail": "IP address 203.0.113.99 is not allowed for this API key"
}

// Domain not in whitelist
{
  "detail": "Domain unauthorized.com is not allowed for this API key"
}

// Missing required scope
{
  "detail": "This action requires the 'write' scope"
}

Common Causes

• Missing Authorization header
• Incorrect API key
• Revoked or expired API key
• Request from non-whitelisted IP address
• Request from non-whitelisted domain (browser apps)
• API key lacks required scope for the action

Rate Limits

API requests are rate limited based on your plan:

Tip: Use the X-RateLimit-Remaining response header to monitor your remaining requests and avoid hitting limits.