Restrict a key (IP, domain and permissions)

You can tighten a key's access in three ways. You'll find them on the key's page under the gear icon Configuration.

Permissions (scopes)

Choose exactly which parts of the API the key may use. A key that only needs to search doesn't need access to everything. Less access = less damage if the key leaks.

IP allowlist (live keys)

Add the IP addresses or CIDR blocks your servers call from. Calls from other IPs are rejected with 403. Perfect for server-to-server setups with fixed IPs.

Domain allowlist (public keys)

Add the domains (origins) your frontend runs on — including https://, e.g. https://example.com. Browser calls from other domains are rejected with 403. A public key without domains does not work at all: every call is rejected. This stops others from stealing your public key and using it on their own site.

Recommendation: Give live keys only the permissions they actually need, and lock them to your servers with the IP allowlist where possible.