Everything around your API keys

Issue, lock, verify, meter and watch keys, set up for 34 industries including banking, CRM, e-commerce and CMS.

Start Building

Team access & two-step sign-in

Five team roles, and two-step sign-in with an authenticator app and backup codes, which an owner can require for the whole team.

Secrets Never Stored Raw

Server keys are kept only as a peppered hash, passwords use bcrypt, and traffic is TLS. A database copy reveals nothing usable.

Domain-Locked Keys

Each key works only for your domain, proved by DNS or a file. IP and country rules on the plans that include them.

Rate Limits & Allowances

A monthly allowance counted over your billing cycle and an optional per-minute limit on each key, enforced at the gateway. Usage shows on your dashboard.

Call Logs & Team Activity

Every call is logged with its result and the reason for any refusal; every team change is on the Activity page and in the evidence pack.

Webhooks

Events for payments, subscriptions and key changes, signed with HMAC-SHA256 and retried when your endpoint fails. On the plans that include them.

Plain HTTP & JSON

No SDK to install: one base URL, JSON in and out, and copy-paste examples in the API reference.

GDPR Tooling

Self-service data export and account erasure, available on every account without contacting support.

What every key gets

Hashed at rest, signed on every reply, and watched from outside twice an hour.

Key security

Hashed

Server keys never stored raw. A stolen database row is not a usable key.

Outside checks

2× an hour

From outside our servers

Every reply

Signed

HMAC, nonce-bound

One documented API

Every endpoint in the API reference, with the request, the reply and the reason codes for each refusal.

Webhooks

Signed events for payments, subscriptions and key changes, retried until your endpoint answers.

Status & reliability

A public status page, incident write-ups and a quarterly uptime report you can hand to an auditor.

Ready to build?

Start on the free plan: every key is domain-locked, metered and logged from its first call.

Start Building

How a BuildAPI key compares with a plain API key