Skip to main content

​
Bearer Token Authentication

All API requests require a Bearer token in the Authorization header. API keys use the imk_ prefix.

​
Key Security

  • Keys are bcrypt hashed before storage. Immutable never stores your raw key.
  • A 20-character prefix is stored for key lookup and identification in the dashboard.
  • Keys are shown only once at creation. If you lose a key, revoke it and generate a new one.
Never expose your API key in client-side code, public repositories, or browser-accessible JavaScript. API keys should only be used in server-side environments. See the Next.js guide for safe patterns.

​
Key Management

Each workspace can have multiple active API keys. The limit depends on your plan: Manage keys from Settings > API Keys in the dashboard:
  • Create new keys with a descriptive label
  • View the prefix of existing keys for identification
  • Revoke keys immediately (takes effect instantly)

​
Environments

Use separate API keys for development and production. Each key is scoped to a single workspace, so you can create a dedicated test workspace with its own keys.

​
Rate Limits

API requests are rate limited per workspace: When rate limited, the API returns 429 Too Many Requests with a Retry-After header indicating when to retry.

​
Error Responses

​
401 Unauthenticated

Missing or invalid API key:

​
403 Forbidden

IP not in allowlist or insufficient permissions:
See IP Allowlisting for restricting API access by IP address.