API keys

In shortYour AI Rank Lab account has one API key and one API secret, shown under Content → Developer API → API keys. The REST API and the MCP server need both, sent as the x-api-key and x-api-secret headers. The same key also connects the WordPress plugin and the audit widget, so rotating it affects them too. Keep the secret private, whitelist the domains that may use the key, and rotate only when you're ready to update every place it's used.

What the key and secret are for

The API key identifies your account. The API secret proves the request really comes from you. Together they let a script, an AI client or another app use AI Rank Lab as you: read your data, run tools and spend your credits. There is one pair per account, created automatically the first time you open the page.

Find, copy and protect your key

1. Open API keysIn the sidebar go to Content → Developer API → API keys. The page is titled API & Integrations and opens on the API Key tab. (Settings → API keys opens the same page.)
2. Copy the key and the secretUse Copy next to Public API Key and API Secret. Store them in your password manager or as environment variables (for example AIRANKLAB_API_KEY and AIRANKLAB_API_SECRET), not in your code.
3. Whitelist your sitesUnder Whitelisted domains, pick a domain from your account and add it. Only whitelisted domains can validate the key from the WordPress plugin. The Max domains badge shows how many sites can activate it; activated sites appear under Licensed domains.
4. Check the Developer API tabThe Developer API tab shows a ready-made cURL request for your credit balance, the endpoint list, and links to the API Playground, Full API documentation, the Postman collection and the OpenAPI spec (JSON).

Rotating the key

Rotate API Key replaces both the key and the secret immediately. There is no confirmation dialog, so click it only when you mean it. Rotate when a secret may have leaked (pasted into a chat, committed to a repo, shared with someone who left) or on a regular security schedule.

1. List every place the key is used: scripts, servers, Claude or Cursor configs, the WordPress plugin, the widget embed.
2. Click Rotate API Key. The page confirms that old keys are now invalid and updates Last rotated.
3. Copy the new key and secret and update each place on your list.
4. Test with a free call, such as the credit balance in the API playground.

What the key can and can't reach

• It acts as you, on domains in your own account. Domains a teammate shared with you aren't available through the API or MCP server; ask the owner to use their own key.
• Each key is allowed 60 requests a minute by default, counted across the REST API and MCP server together.
• Send the key and secret as headers. Don't put them in a URL: addresses end up in logs, browser history and proxies.
• The old /api/mcp endpoint you may see in older notes is a different, legacy feature. Use /api/v1 and the MCP server described in the MCP lesson.