Skip to main content

API Key Authentication

Include your API key in the X-API-Key header with every request:

Getting Your API Key

1

Contact Support

Send an email to hello@arqqin.com with your integration requirements and the locations you need access to.
2

Provide Details

Include your company information, use case, and the specific locations you’ll be managing.
3

Receive Your Key

Our team will generate and provide you with an API key within 1-2 business days.

API Key Security

Never expose your API key in client-side code or public repositories. API keys provide full access to your whitelist data and should be treated as sensitive credentials.

Security Best Practices

Store your API key securely:
  • Use environment variables in production
  • Never commit keys to version control
  • Rotate keys regularly
  • Use different keys for different environments
Secure your API requests:
  • Always use HTTPS endpoints
  • Validate responses before processing
  • Implement proper error handling
  • Use rate limiting in your applications

API Key Scope

API keys are scoped to provide appropriate access for your use case:
  • Location Access: Each API key provides access to designated locations
  • Permission-Based: Keys are configured with appropriate permissions for your integration needs
  • Audit Trail: All API usage is logged and auditable
Contact hello@arqqin.com to obtain your API key and configure the appropriate permissions for your use case.

Error Responses

Invalid API Key

Missing API Key

Insufficient Permissions

Rate Limiting

API keys are subject to rate limiting to ensure fair usage:
  • Limit: 1000 requests per hour per API key
  • Headers: Rate limit information is included in response headers
  • Exceeded: Requests exceeding the limit return a 429 status code

Testing Authentication

You can test your API key authentication using the health check endpoint:

Need Help?

Contact Support

Get help with API key setup and authentication issues.

Quickstart Guide

Learn how to make your first authenticated API calls.