How to Create and Use an API Key on SolumeCore

To create a SolumeCore API key, open API & webhooks in the panel menu, click New key, name it and confirm it is you. Copy the secret that appears, because it is shown only once. Then ask us by ticket to authorize the IP addresses your program will call from: the key doesn't answer until that is done.

What an API key can do

An API key is like a password for your programs. It acts on your own services only, never on anyone else's, and it can do the following through the public API:

• List your services and read the details of one: id, host name, status, plan and IP.
• Start, stop or restart a service that has a server instance, such as a VPS or VDS.
• Read and edit the firewall settings of a service.

Keys have no separate permission levels: a valid key can use all of the above on every service of your account. Because of that, create one key per program so you can revoke each one on its own.

Create a key

1. Log in at dashboard.solumecore.com.
2. In the menu, under Account, open API & webhooks. You land on the API keys tab.
3. Click New key (or Create your first key).
4. Type a Name that tells you what uses it, like "Reseller panel". Up to 60 characters.
5. Click Create key.
6. The panel asks you to confirm it is you with your password, a 2FA code, your passkey or an email code. This is required because a key outlives your session.
7. A window Save your key now shows the Secret key. It starts with sk_live_. Copy it into your password manager or secrets store.
8. Tick I saved it. If you lose it, we can't show it again: create another one.

The list then shows your key by name and its first characters, with its authorized IPs, last use, creation date and status.

Get your IP authorized

For security, a key works only from IP addresses that our team authorizes for it. You can't add them yourself.

1. After saving the key, click Ask to authorize IPs. A ticket opens with the subject and message ready.
2. Replace the placeholder with the public IP addresses your program will call from, one per line.
3. Send the ticket. We authorize them by hand, usually within a few hours.
4. When they are approved, the Authorized IPs column shows them instead of Waiting for IPs.

Find the public IP of the machine that will make the calls. A fixed address works best, such as the one of a server, because home connections often change their IP and the key would stop working until we authorize the new one.

Make your first call

Send the key in the Authorization header. The Quick start tab of the same page has the API address and examples ready to copy. Replace YOUR_API_KEY with your key.

curl https://api.solumecore.com/v1/services \
  -H "Authorization: Bearer YOUR_API_KEY"

const r = await fetch('https://api.solumecore.com/v1/services', {
  headers: { Authorization: `Bearer ${process.env.SOLUME_API_KEY}` },
});
console.log(await r.json());

import os, requests

r = requests.get(
    "https://api.solumecore.com/v1/services",
    headers={"Authorization": f"Bearer {os.environ['SOLUME_API_KEY']}"},
)
print(r.json())

The answer is a list of your services:

[
  {
    "id": "vps-3315",
    "hostname": "web-prod",
    "estado": "ACTIVO",
    "plan": "VPS 4 GB",
    "ip": "203.0.113.42"
  }
]

To restart a service, call the power endpoint with the id from that list. Use start, stop or restart. It answers 204 when it is done.

curl -X POST https://api.solumecore.com/v1/services/vps-3315/power/restart \
  -H "Authorization: Bearer YOUR_API_KEY"

The endpoints are GET /v1/services, GET /v1/services/:id, POST /v1/services/:id/power/:action and the firewall routes under /v1/services/:id/firewall.

Limits

Requests are limited per key and per IP. By default you can make 300 general requests per minute, 20 power actions per minute and 60 firewall requests per minute. When you go over, the API answers 429 and the retry-after header says how many seconds to wait. The x-ratelimit-limit and x-ratelimit-remaining headers show your quota.

Revoke or delete a key

1. In the API keys tab, open the options menu (three dots) of the key.
2. Choose Revoke and confirm. It stops working immediately and any program using it gets errors.
3. A revoked key can then be removed from the list with Delete, typing its name to confirm. This can't be undone.

Resetting your password through the email link also revokes all your API keys. See how to reset a forgotten password.

Troubleshooting

401: invalid or revoked key

The Authorization: Bearer ... header is missing, the key was copied incompletely, or it was revoked. Create a new key if you lost the secret.

403: this IP is not authorized

The call came from an address that is not on the key's list. Check the public IP of the machine, or ask us to add it. A 403 also appears if the account is suspended or the IP is blocked.

409: the service isn't active yet

Power actions only work once the service is active and ready. Check its status in the panel.

429: too many requests

Slow down and retry after the seconds in retry-after. Cache the service list instead of asking for it on every call.

FAQ

Is the API free?

Creating keys costs nothing. Anything you do with the API follows the same rules and billing as in the panel.

Can I see my secret key again?

No. We keep only a protected fingerprint of it, so the secret is shown once when you create it. Create a new key if you lose it.

Can I limit what a key can do?

There are no per-key permissions. The safest setup is one key per program, authorized only from the IPs it needs, and revoked as soon as you stop using it.

What if my key leaked?

Revoke it right away from the key's menu, create a new one and update your programs. Then review your account activity.

Related articles

• How to manage sessions and devices
• How to turn on two-factor authentication
• How to open a support ticket
• How to connect to your VPS over SSH

Building something that needs reliable servers? Take a look at our VPS plans.