This help guide explains what to do if entering your API key on the API Help page returns No API Key applied, or the API returns An unauthorized request has been made. In most cases, the IP address you are connecting from needs adding to the key's IP Allow List.
Contents
- Introduction
- Add your IP address to the IP Allow List
- Finding the right IP address
- Check the API key
- API error messages
Introduction
When you enter a key on the Authentication tab of the API Help page (https://<yoursystem>.ciphr.com/api/Help) and click Connect, you will see one of the following:
- API Key applied: the key is valid for your IP address, and the Operations section lists what the key can access.
- No API Key applied: the key has not been accepted.
No API Key applied is shown for either of two reasons:
- The IP address you are connecting from is not on the key's IP Allow List. This is the most common cause. A correct key is rejected if the request comes from an IP address that has not been allowed.
- The key is not correct, for example it was copied incompletely or has since been regenerated.
The message is the same for both, so always check the IP Allow List first.
| Note: The Help page checks the IP address of the computer you are using to view it. If your integration runs on a server or a third-party platform, both that IP address and your own need adding if you want to use the Help page as well. For more on setting up keys, please review the API Configuration guide. |
Add your IP address to the IP Allow List
The IP Allow List can be accessed via the following area:
- Latest (left-hand) menu: System Configuration > API Configuration
- Pre 2025 (top) menu: System > Security > API
- Click Configuration against the relevant key. The current list is shown in the IP Allow List field.
- Click the IP Allow List button.
- Click Add to add a new line, then choose:
- Single for one IP address, or
- Range for a range of addresses, entering the first and last address.
- Enter the address in the four boxes. The box after the colon is for a port and can be left blank.
- Click Update to close the IP Allow List window.
- Click Update at the bottom of the Configuration page. A message confirms Your Configuration has been successfully updated.
| Note: The change is not saved until you click Update on the Configuration page as well as in the IP Allow List window. It can then take a few minutes to apply to every request, so if you still see No API Key applied straight away, wait a few minutes and try again. |
Finding the right IP address
The address to add is the public (external) IP address that requests come from, not the internal address of the computer or server (such as one beginning 192.168. or 10.).
| Where the request comes from | How to find the IP address |
|---|---|
| Your own computer (for example the Help page or Postman) | Search for "what is my IP address" in a browser on the same computer and network. If you use a VPN, check while connected to it. |
| Your own server or integration | Ask your IT team for the server's outbound public IP address. |
| A third-party supplier or cloud platform (for example a payroll, reporting or integration provider) | Ask the supplier for the IP addresses or range their service connects from. These are not the same as your office IP address. |
| Note: If a key that used to work suddenly returns No API Key applied, the IP address may have changed, for example after a change of broadband provider, working from home, a new VPN or a supplier moving platform. Check the current address and update the IP Allow List. |
Only add the addresses that need access. Avoid allowing every address (0.0.0.0 to 255.255.255.255), as this removes the protection the IP Allow List provides.
Check the API key
If the IP address is on the IP Allow List and you still see No API Key applied, check the key itself:
- Copy the whole key. Make sure no characters are missing and no line breaks have been added, for example when copying from an email or document.
- Check the key has not been regenerated. Clicking Regenerate API Key replaces the key, and the old key stops working.
- Check the expiry date. The Expiry date is shown in the key list and on the Configuration page.
The key is masked on the Configuration page. If you do not have a copy, click Regenerate API Key, copy the new key and click Update.
| Note: Regenerating the key affects every integration using it. Update the key in each of them, or contact the supplier, before relying on the new key. |
API error messages
Outside the Help page, the same problems return the following errors from the API, with status 400:
| Response | Meaning | What to do |
|---|---|---|
An unauthorized request has been made | The IP address is not on the IP Allow List, or the key is not correct | Add the IP address to the IP Allow List, then check the key |
An invalid request has been made | The key has not been sent in the expected format | Check the request headers, as shown below |
The key must be sent in the Authorization header, starting with apikey followed by a space:
Authorization: apikey <YourAPIKey> Accept: application/json
Leaving out apikey, or using Bearer instead, returns An invalid request has been made.
Footer
Comments
0 comments
Please sign in to leave a comment.