Unplugg Authentication: API Key Setup & Security (2026)

Authentication overview

Unplugg's API authentication system is designed to provide secure and controlled access to its suite of generative AI content moderation services, including the Content Moderation API, PII Detection API, and Toxicity Detection API. The system relies on a token-based approach, ensuring that all interactions with the API are authenticated and authorized Unplugg API documentation. This method helps protect data integrity and prevent unauthorized usage of your account's API quota.

Authentication is a foundational security measure, verifying the identity of a client before granting access to resources. For Unplugg, this means confirming that an application making an API call has the necessary permissions associated with a valid Unplugg account. Once authenticated, subsequent requests are authorized based on the privileges linked to the provided credentials.

The chosen authentication mechanism is straightforward, aiming to simplify developer integration while maintaining a high standard of security. Developers are responsible for safeguarding their authentication credentials, as these keys act as direct access passes to Unplugg's services and associated account resources.

Supported authentication methods

Unplugg primarily supports API Key authentication. This method is common for web services due to its simplicity and effectiveness for server-to-server communication or applications where the client can securely store the key.

API Key (Bearer Token)

The API Key method involves generating a unique key from your Unplugg dashboard. This key then acts as a bearer token in the Authorization header of your HTTP requests. When the API receives a request, it validates the bearer token against its records to determine if the request is legitimate and from an authorized user.

This approach is suitable for:

• Backend services: Applications running on secure servers can store API keys safely.
• Command-line tools: Scripts and automated processes benefit from direct, token-based access.
• Rapid prototyping: Quick integration with minimal setup overhead.

The API key functions as the primary credential for accessing Unplugg's API endpoints. It grants full access to the services enabled for your account, making its secure handling critical.

The following table summarizes the supported authentication method:

Getting your credentials

To interact with the Unplugg API, you need to obtain an API key from your Unplugg account dashboard. The process is designed to be self-service and provides immediate access upon generation.

Steps to obtain your API Key:

1. Sign Up/Log In: Navigate to the Unplugg website and either create a new account or log in to your existing one.
2. Access Dashboard: Once logged in, locate and access your developer dashboard. This dashboard is the central hub for managing your account, usage, and credentials.
3. Navigate to API Keys Section: Within the dashboard, there will be a dedicated section or tab for "API Keys" or "Developer Settings."
4. Generate New Key: Click on the option to "Generate New API Key." You may be prompted to name your key for organizational purposes, especially if you plan to use multiple keys for different applications.
5. Securely Store Your Key: Once generated, your API key will be displayed. This is typically the only time the full key is shown. Copy it immediately and store it in a secure location. Unplugg will not store this key in a recoverable format for security reasons, meaning if you lose it, you will need to generate a new one.

It is recommended to generate distinct API keys for different applications or environments (e.g., development, staging, production). This practice allows for easier key rotation and revocation if a specific key is compromised, without affecting other services.

Authenticated request example

Once you have obtained your API key, you can include it in the Authorization header of your HTTP requests to Unplugg's API. The key should be prefixed with Bearer, following the OAuth 2.0 bearer token scheme OAuth 2.0 Bearer Token usage. All API requests must be made over HTTPS to ensure the secure transmission of your API key and data.

Here's an example using curl to make a moderated content detection request:

curl -X POST \  https://api.unplugg.com/v1/moderate \  -H "Authorization: Bearer YOUR_UNPLUGG_API_KEY" \  -H "Content-Type: application/json" \  -d '{"text": "This is a test message to analyze."}'

In this example:

• YOUR_UNPLUGG_API_KEY should be replaced with the actual API key you generated from your Unplugg dashboard.
• The Authorization header contains the Bearer prefix followed by a space and then your API key.
• The request body contains the JSON payload with the text to be moderated.

For programmatic integration, Unplugg provides official SDKs for Python and Node.js Unplugg SDK documentation. These SDKs handle the details of constructing the HTTP requests and including the API key correctly, simplifying the integration process. Developers can find detailed examples for both languages within the Unplugg API reference documentation.

Security best practices

Properly managing your Unplugg API keys is crucial for maintaining the security and integrity of your applications and data. Adhering to these best practices can mitigate common security risks:

1. Treat API Keys as Sensitive Credentials: Your API key provides programmatic access to your Unplugg account. Treat it with the same level of security as your password. Do not hardcode API keys directly into your application's source code, especially for client-side applications or publicly accessible repositories.
2. Use Environment Variables or Secret Management Services: For server-side applications, store API keys in environment variables. For more complex deployments or microservices architectures, consider using a dedicated secret management service like AWS Secrets Manager AWS Secrets Manager documentation, Google Secret Manager Google Secret Manager documentation, or Azure Key Vault Azure Key Vault overview.
3. Restrict Access to Keys: Limit who has access to your API keys. Only developers and systems that absolutely require access should have it. Implement role-based access control where appropriate.
4. Transmit Keys Over HTTPS Only: All communication with the Unplugg API occurs over HTTPS/TLS, encrypting the data in transit. Ensure that your application also enforces HTTPS for all its communications to prevent man-in-the-middle attacks that could expose your API key.
5. Regularly Rotate API Keys: Periodically generate new API keys and revoke old ones. This practice reduces the window of opportunity for a compromised key to be exploited. A common rotation schedule might be every 90 days, or immediately if a compromise is suspected.
6. Implement IP Whitelisting (if available): If Unplugg offers IP whitelisting capabilities, configure your API keys to only accept requests from specific, trusted IP addresses. This adds an extra layer of security, blocking requests from unauthorized locations even if a key is leaked. Refer to Unplugg's documentation for features like IP whitelisting if they become available.
7. Monitor Usage and Logs: Regularly review API usage logs provided by Unplugg to detect any unusual activity or unauthorized access patterns. Set up alerts for unexpected spikes in API calls or errors that might indicate compromise.
8. Revoke Compromised Keys Immediately: If you suspect an API key has been exposed or compromised, revoke it immediately through your Unplugg dashboard and generate a new one.