API keys
Every request is authenticated with an API key sent in the X-Api-Key header:
The Akamai BMP service also accepts the key as a bearer token, which some HTTP clients make easier to configure:
Keys are per product — an Akamai Web key does not work on Akamai BMP, and vice versa.
Keep keys server-side. Never embed them in a browser bundle, mobile app, or public repository.
Rate limiting
Each key has its own request budget. When you exceed it, the API returns 429. Back off and retry;
the limit is a short rolling window, not a permanent block. See Rate limits.
Error responses
Errors return a JSON body with a single error field and the matching HTTP status. Error messages
are intentionally generic — they never reveal why a request failed, so an attacker cannot use
them to probe the service. Use the status code to decide how to react, and your own logs/request id
for debugging.
See Errors for the full list of status codes.
