Protect Your OtpGet API Key: IP Whitelist, Daily Buy Limit and Activity Log

Your API key spends your wallet. If it leaks, someone else can buy numbers at your cost. The good news is that OtpGet gives you three simple controls that turn a leaked key into a harmless string. All of them live on the API Tool page of your dashboard.

1. Allowed IPs

Add the IP address of your server, one per line, or a range such as 203.0.113.0/24. Any request from a different IP is refused with IP_NOT_ALLOWED. If someone steals the key, it is useless to them. Leave the list empty only if your server IP changes constantly.

2. Daily buy limit

Set the maximum number of purchase requests your key can send in a rolling 24 hours. It counts buying actions across all APIs: temporary numbers, cheap and premium numbers, email orders, rentals and renewals. Set it slightly above your normal daily volume. If a script goes wrong, or the key is abused, spending stops at the limit. A value of 0 means unlimited.

3. Recent API activity

The same page lists the IP addresses that recently used your key. Check it now and then. If you see an IP you do not recognize, generate a new key immediately.

Good key hygiene

• Call the API only from your own server. Never from a website, a mobile app or a browser script, where anyone can read the key.
• Keep the key out of source control; use environment variables.
• Use a different key for staging and production, or the sandbox key for testing.
• Rotate the key when a team member who knew it leaves.

Sandbox keys are separate

The sandbox key is not affected by the IP list or the buy limit, because it can never spend real money.

A 5-minute security checklist

1. Add your server IPs to the allowed list.
2. Set a daily buy limit.
3. Check the recent activity list.
4. Move the key to an environment variable.

Start building with OtpGet

Create a free account at otpget.com, copy your API key from the dashboard and open the API documentation. Our support team is available 24/7 if you get stuck.