Get started
Authentication
Every request carries an API key as a bearer token. Keys belong to your account, and everything they do is counted against its quota and listed in your dashboard.
Sending the key
Put the key in the Authorization header on every request. There are no other ways to send it — not a query parameter, not a cookie.
POST /v1/check HTTP/1.1
Host: api.ihatecorruptfiles.xyz
Authorization: Bearer ihcf_live_4f9KcX2…Your keys
A key is ihcf_live_ followed by 32 letters and digits. We store only a hash of it, so it is shown once, when you create it, and never again — if you lose it, make a new one. The dashboard identifies each key by its name and its first few characters, and shows when it was last used.
An account can have up to five active keys. Use one per place the key lives — production, staging, a CI runner — so you can revoke one without touching the others.
Keeping it secret
Anyone with the key can spend your quota. Keep it in an environment variable or your platform's secret store, and call the API from your server, never from a browser or a mobile app where the key would ship to users.
If a key ends up in a repository, a log or a chat, revoke it and create another. It is quicker than wondering.
Revoking a key
In the dashboard, open API keys and revoke it. It stops working on the next request; there is no delay and no undo. Requests it made stay in your logs.
When it goes wrong
A missing key is 401 unauthorized; a wrong one 401 invalid_api_key; a revoked one 401 key_revoked. None of them count against your quota. The error reference lists every code.