​

Authentication

​

API key format

paid_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

• Prefix: paid_ (37 characters total)
• 32 hex characters of cryptographic randomness after the prefix
• Hashed with HMAC-SHA256 in our database — we cannot recover a lost key
• Cached in Redis for sub-millisecond validation
• One key carries the full plan and scope set of the user who created it

​

Creating an API key

​

From the dashboard

1. Open propaideals.co.uk/dashboard/api
2. Click Create API Key
3. Enter a descriptive name (e.g. production-server, staging-app)
4. Copy the key from the modal — this is the only time it will be shown
5. Store it in your secret manager (1Password, AWS Secrets Manager, Doppler, etc.)

​

Limits

• Maximum 5 active keys per user
• Revoke an old key before creating a 6th
• Each key inherits its plan from your active subscription
• All your keys share one quota. Rate limit, monthly request quota, and AI chat quota are pooled per account — creating more keys does not increase your limits (see Rate limits)

​

Sending the key

GET /api/v1/properties HTTP/1.1
Host: api.propaideals.co.uk
Authorization: Bearer paid_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
Accept: application/json

curl https://api.propaideals.co.uk/api/v1/properties \
  -H "Authorization: Bearer $PROPAIDEALS_API_KEY"

fetch('https://api.propaideals.co.uk/api/v1/properties', {
  headers: { Authorization: `Bearer ${process.env.PROPAIDEALS_API_KEY}` },
})

import os, requests
requests.get(
    "https://api.propaideals.co.uk/api/v1/properties",
    headers={"Authorization": f"Bearer {os.environ['PROPAIDEALS_API_KEY']}"},
)

​

Scopes

{
  "error": {
    "code": "insufficient_scope",
    "message": "This key lacks the required scope: properties:read"
  }
}

​

Rotating keys

1. Create a new key in the dashboard
2. Deploy it to your application as a new env var
3. Verify traffic is flowing on the new key (check last_used in the dashboard)
4. Revoke the old key

​

Two authentication systems

​

Security best practices

• Never put API keys in client-side JavaScript, mobile apps, browser extensions, or public source control. Anyone with the key can use your full quota.
• Use environment variables. process.env.PROPAIDEALS_API_KEY in Node, os.environ["PROPAIDEALS_API_KEY"] in Python.
• Use a secrets manager in production (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault, Doppler, 1Password Secrets Automation).
• Restrict by network where possible — IP allowlisting on your egress proxy adds defence in depth.
• Monitor last_used in the dashboard to detect inactive keys.
• Rotate regularly. If you ever leak a key, revoke it within minutes.
• One key per environment. Use a separate key for production, staging, and local development.

​

Verifying a key works

curl -i https://api.propaideals.co.uk/api/v1/properties?limit=1 \
  -H "Authorization: Bearer $PROPAIDEALS_API_KEY"