ACCESS & AUTHENTICATION
One key.
A considered boundary.
Use an account API key in the Authorization header. Never place keys in URLs, public repositories, analytics events or browser-delivered production code.
Before you generate a key
- Create an account with your email address and a strong password.
- Verify your Australian mobile number by SMS. Credits and key creation are unavailable until verification succeeds.
- Open your developer account, create a key and store the secret immediately. The full key is displayed once.
Authorization: Bearer YOUR_API_KEY Accept: application/json
Keys are account-wide
You can keep up to two active keys. Keys share the same credit balance, daily request allowance and minimum interval. A second key is useful for rotation; it does not create another quota.
Rotate or revoke
Create a replacement key, update your application’s secret store, test one request, then revoke the old key. Revocation is permanent. If a key is exposed, revoke it immediately from your account.
The request builder keeps a key only in the current page’s memory. It does not save it to local storage. Requests run only when you select “Send request” and are subject to normal credits and limits. For a production application, call ListingData from your own backend.
Authentication failures
| Status | Meaning | What to do |
|---|---|---|
401 | Missing, invalid or revoked key. | Check your Bearer token and key status. |
403 | Account is not eligible for API access. | Complete verification or check your account. |
402 | Monthly credit allowance exhausted. | Wait for the monthly reset shown in your account. |
429 | Minimum interval or daily request limit reached. | Respect the retry/reset information in the response. |