API keys
Creating, scoping and rotating keys.
Keys are created in the dashboard under API, or over the API itself with a key that has the keys:write scope. The secret is shown once at creation and never again.
curl https://api.wproxy.io/v1/usage \
-H "Authorization: Bearer wpk_live_8f21c0a4e91b7d3f"Scopes
| Scope | Grants |
|---|---|
| usage:read | Traffic and request statistics |
| proxy-users:read | List sub-users and their configuration |
| proxy-users:write | Create, modify and disable sub-users |
| limits:write | Change traffic and spend ceilings |
| billing:read | Balance, invoices and payment methods |
| billing:write | Top up, change plan, cancel subscription |
| keys:write | Create and revoke other API keys |
Scope down deployment keys
A key that only needs to read usage should not be able to cancel your subscription. Keys are free; create one per integration with the narrowest scope that works.
Rotation
Rotating issues a new secret and keeps the old one valid for a grace period you choose, up to seven days. Both work during the overlap, so you can deploy without a synchronised cutover.
curl -X POST https://api.wproxy.io/v1/keys/wpk_8f21c0/rotate \
-H "Authorization: Bearer $WPROXY_API_KEY" \
-d '{ "grace_hours": 48 }'Rate limits
600 requests per minute per key. Responses carry x-ratelimit-remaining and x-ratelimit-reset; exceeding the ceiling returns 429 with a retry-after header. The proxy gateways have separate, far higher limits — this ceiling applies only to the management API.