IP-Bound API Keys: Connecting QUOTC to Your Server

An API key identifies a connection to a service. An IP restriction adds another condition: requests must also come from the server address assigned to that key.

QUOTC uses this approach for both test and production keys. Understanding the restriction before integration can help you avoid connection problems when deploying or moving your application.

Which IP should you enter?

When creating a key, enter the IP address of the server that will send requests to QUOTC.

This may differ from the address you use to open your website or connect to your hosting control panel. The relevant address is the one QUOTC receives as the source of your server’s requests.

If your infrastructure uses a proxy, gateway or other network intermediary, confirm which outgoing address applies before creating the key.

Do not automatically use the IP of your own computer or phone. Unless that device is making the API requests, its address is not the one your integration needs.

Keep the connection on your server

For a website serving multiple visitors, a server-side connection provides a clear way to work with an IP-bound key.

Your server requests the quotation data, processes it and delivers the information your interface needs. Visitors interact with your application without receiving the QUOTC credential.

Direct requests from visitors’ browsers originate from their individual network addresses. They also risk exposing the key in browser tools or client-side code.

Keep the credential in server configuration with appropriate access controls. Do not include it in public JavaScript, downloadable files or a source-code repository.

An IP restriction does not replace credential security

Restricting a key to an IP address does not make the key safe to share.

An exposed credential can still create risks, particularly if someone also gains access to the authorised server. Protect the key and the server together.

Avoid placing full keys in application logs, screenshots or support messages. In the QUOTC dashboard, keys appear as a mask showing only their first and last three characters. The Copy key action copies the complete value when you need it for configuration.

Plan server changes before deployment

Moving your application can change the address from which API requests originate. A new hosting provider, network configuration or deployment environment may therefore require an IP update.

Users cannot edit a key’s server IP directly in the dashboard. Contact QUOTC support to request the change.

Before moving your integration:

• Confirm the new server’s outgoing IP address.

• Identify the affected key using its mask and current server IP.

• Coordinate the change with support.

• Verify the connection from the new server after the update.

Changing an IP address does not, by itself, activate an inactive key or renew an expired access period.

Diagnose access problems systematically

If your integration stops receiving data, check more than the credential alone.

Confirm that the key is active, its access period has not expired, the requested currency pair is permitted and requests originate from the assigned IP. Check the API documentation for the meaning of any returned error.

Avoid repeated uncontrolled retries. Preserve useful diagnostic information while keeping credentials out of logs.

Separate access control from data meaning

A successful connection confirms that your application can access the service. It does not change the nature of the information supplied.

QUOTC quotations are algorithmically generated. They are not official exchange prices and do not reflect actual market conditions.

Keep that distinction clear in your application while using IP restrictions and credential protection to maintain an orderly, secure integration.