Authentication

Getting a keyCopy Anchor Link

Keys are issued in the developer portal, there is no need to ask us.

1. Sign in on the website with Google and open the developer portal: /en/dashboard.
2. Fill in the connection form: the project name, where it will run (bot, website, app), your region and a contact email. The company and its first Project are created right away. One account (Google or Telegram) owns one company.
3. Open the Project and issue a key (the label is optional, for example prod or staging). The key is shown only once: put it into your server environment variables right away.

In the same portal you can add more Projects, revoke keys, set up the webhook and see your orders, balance and its movements. We top up the balance: contact us, the portal only shows it.

API keyCopy Anchor Link

Every request passes the Project key in a header:

X-API-Key: ifk_<clientId>_<secret>

• clientId is the public part we use to find the key; secret is a high-entropy secret. We store only its SHA-256, so a lost key cannot be recovered: issue a new one.
• A Project can have several keys: issue a new one, switch your service over, then revoke the old one. This rotates the key with zero downtime. Revocation takes effect immediately.
• The key grants access to all orders of its Project and to your account balance. Never put it in client code (browser, mobile app, user-side bot) or in a repository; keep it only in server environment variables.

A missing, invalid or revoked key returns 401.

const res = await fetch('https://api.ifragment.com/v1/balance', {
  headers: { 'X-API-Key': process.env.IFRAGMENT_KEY! },
});

IP allowlistCopy Anchor Link

You can enable a list of allowed IPs (or CIDR subnets) for a Project. A request with a valid key from any other address then gets 403. We recommend enabling the allowlist for production keys: a leaked key is useless without your server.

The current list is shown on the Project page in the developer portal; we set and change it at your request. If you are behind NAT or a cloud load balancer, specify the server's outgoing address.

IdempotencyCopy Anchor Link

Every POST that creates a resource requires an Idempotency-Key header (8 to 128 characters [A-Za-z0-9._:-]). See Orders for details.

curl -X GET "https://example.com/v1/me"

{  "success": true,  "data": {    "projectId": "3b0c8f5e-2d41-4c6a-9f1e-7a5b2c9d4e10",    "tenantId": "8e2f4a6c-1b3d-4e5f-a7b9-c0d1e2f3a4b5",    "projectName": "Main bot"  },  "meta": {    "requestId": "9f1c2b7e-3a4d-4e5f-8a6b-7c8d9e0f1a2b",    "timestamp": "2026-10-06T09:15:22.481Z",    "processingTimeMs": 38  }}