---
title: "API Keys"
slug: "api-keys"
updated: 2026-09-01T15:39:05Z
published: 2026-09-01T15:39:05Z
canonical: "learn.servitly.com/api-keys"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://learn.servitly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

To invoke Servitly APIs from third-party systems, the Servitly backend is expecting a valid API Key used to identify the remote client. Before dealing with APIs, you need to create an API Key.

## Creating API Key

In order to create a new API Key, you must follow these steps:

1. Enter the *Integration / API* Keys page.

1. Click on the *Create API Key* button.
2. A new API Key will be added to the list of all API Keys.
3. Complete the API Key configuration by defining constraints and permissions.

![](https://cdn.document360.io/6759e9c9-3ce3-49df-965a-7231d2d9a10a/Images/Documentation/image(288).png?sv=2026-02-06&spr=https&st=2026-10-16T17%3A20%3A35Z&se=2026-10-16T18%3A20%3A35Z&sr=c&sp=r&sig=pJmfxvWfQ2OVkpXCy1oOSzRmGuDMaj4eGhhPaiBdHmU%3D)

## Restrictions

The restriction section allows defining a filter protecting against unauthorized usage. It is possible to define a valid source domain (e.g., *.acme.com) or a valid mobile application package name (e.g., com.acme.mobile.app).

## Permissions

Within the Permissions section, you can specify the permissions to limit the operations a client can perform via API. When using an API key, user permissions are further restricted according to the permissions associated with the API key.

For more details about available permissions, refer to the [User Permissions](/docs/user-permissions) article.

## Using an API Key

The API Key must be issued to the server during the client login.

```http
/identity/users/login?apikey=37b51d19467513e45b56f7824f2d51f2
```

For more details you can refer to the authentication endpoints documentation:

- [User credentials login](/apidocs/user-login-credentials)
- [PAT login](/apidocs/user-login-pat)
- [OpenID Connect login](/apidocs/user-login-openid-connect)

In case you are making API requests from a Mobile App using an API Key with Mobile restriction, the `Application ID` must be attached to the HTTP header `User-Agent` at any request.

```http
User-Agent: Mozilla/5.0 My Browser;com.acme.mobile.app
```

> [!WARNING]
> Note that if an API Key is deleted, all the clients using it will no longer be able to call the Servitly API.

## Restrict access to only one device per user

In case of Mobile App Restriction, you can also select whether the access can be made from only one mobile device per user at a time. If selected, when a user logs in from a mobile device, he is automatically logged out of other mobile devices. Push notifications will also be turned off on the devices where the automatic log-out occurs.

## Rate Limit

The whole DPS is limited in the number of maximum requests per hour a remote client can perform through the REST API; this limit depends on the agreement between the Manufacturer and Servitly. Moreover, in case an API key must be used by a third-party client, it is possible to set a rate limit that avoids consuming all requests available on the tenant.

For instance, if the tenant has a limit of 500 requests/hour, it is possible to configure 5 API keys with a rate limit set to 100 requests/hour. But in case the total amount of requests/hour exceeds 500, all the clients will be blocked for a while until a new buffer of requests is available. For these reasons, be careful when defining the rate limits according to the whole tenant rate limit.