API Keys

Every request to the iGaming Finder API requires an API key. Create and manage keys in your Account dashboard.

Keys use the client_ prefix:

text 
client_7f3a2b1c9d4e...

Passing Your Key

Two methods are supported. Use whichever fits your stack.

Header (recommended):

bash 
curl -H "X-API-Key: igf_demo_9457cf242d0c43404fb69b8273d7f4371716682a12c74e3c3274fd8957ebeae7" \
  "https://api.igamingfinder.com/v1/companies/search/preview?q=crypto"

Bearer token:

bash 
curl -H "Authorization: Bearer igf_demo_9457cf242d0c43404fb69b8273d7f4371716682a12c74e3c3274fd8957ebeae7" \
  "https://api.igamingfinder.com/v1/companies/search/preview?q=crypto"

Both methods are equivalent. If both are present, X-API-Key takes precedence.

Error Responses

Missing or invalid key returns 401 Unauthorized:

json 
{
  "success": false,
  "message": "Unauthorized",
  "errors": {},
  "timestamp": "2026-05-03T10:30:00Z"
}

Rate Limits and Quotas

Each plan grants an upfront credit allowance (granted, no monthly reset). When your balance is exhausted, the API returns 429 Too Many Requests:

json 
{
  "success": false,
  "message": "Credit balance exhausted — top up or upgrade your plan",
  "errors": {
    "code": "quota_exceeded",
    "details": {
      "granted": 1000,
      "used": 1000,
      "reserved": 0
    }
  },
  "doc_url": "https://igamingfinder.com/docs/errors.md",
  "timestamp": "2026-05-03T10:30:00Z"
}

This quota 429 is separate from the per-IP throttle. Public /v1 requests are limited to 100 requests per minute per IP. A throttle response includes Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset; wait for Retry-After instead of changing your credit balance.

Check your remaining credits anytime:

bash 
curl -H "X-API-Key: igf_demo_9457cf242d0c43404fb69b8273d7f4371716682a12c74e3c3274fd8957ebeae7" \
  https://api.igamingfinder.com/v1/account

Credit Costs

OperationCost
Enrich domain 10 credits (0 if cached)
Cached enrichment result 0 credits / request
Create export (POST /exports) Variable (number of results × the matching resolve price)
All status/poll endpoints 0 credits / request
Get account info (GET /account) 0 credits / request
Prospect lists (list, show, download) Included with your prospect lists
Lobby monitor (on-demand run) 10 credits / run
Company search preview (count and cost) (GET /companies/search/preview) 0 credits / request
Company search result row (GET /companies/search) 1 credit / result returned
Company resolve profile (GET /companies/resolve) 3 credits / profile returned
Domain verdict resolve (GET /domains/resolve) 1 credit / verdict returned
Domain search result row (GET /domains/search) 1 credit / result returned
Logo catalogue search (GET /logos/search) Free
People role glossary (GET /people/roles) Free
Domain resolve — Operator Launch Profile (GET /domains/resolve?include[]=operator_launch_profile) 5 credits / delivered profile
Company resolve — firmographics result (GET /companies/resolve?include[]=firmographics) 12 credits / delivered Domain result
Company people — contact (GET /companies/:company_ref/people) 9 credits / contact returned
Licensed market entry Signal (GET /signals/market-entries) 1 credit / Signal returned
Platform new-site Signal (GET /signals/platform-sites) 1 credit / Signal returned
Official register change Signal (GET /signals/register-changes) 1 credit / Signal returned
License search preview (count and cost) (GET /licenses/search/preview) 0 credits / request
License search result row (GET /licenses/search) 1 credit / result returned
License resolve profile (GET /licenses/resolve) 3 credits / profile returned
$ help --topic=warning
Never expose your API key in client-side code, public repositories, or browser requests. Keys grant full access to your account.

Key Rotation

To rotate a compromised key:

  1. Go to Account > API Keys
  2. Create a new key
  3. Update your integration with the new key
  4. Delete the old key

The signed-in Account usage views show requested_at, endpoint, status, credits, duration_ms, filtered request_params, settlement_status, source, client_version, mcp_tool_name, connector_session_id, mcp_client_name, and mcp_client_version. Customer rows remove stored domain and host. The overview defaults to 10 rows per page and caps per_page at 50; the compact usage list is limited to 50 recent rows. Request parameters use server-side secret filtering and become { "_truncated": true } above 8,192 stored JSON bytes. The usage log has no stated retention period.