API and MCP
API keys
Create scoped nhm_ keys under Settings: resource scopes, the Enterprise-only write scope, optional expiry, the hourly rate limit, ten active keys, and usage.
Updated · 2 min read
An API key is a bearer token of the form nhm_ followed by 64 hex characters. It is shown once at creation and stored hashed; the dashboard shows only its prefix afterwards.
Where
- Web: Settings, API Keys.
- iOS: Account, API keys (Pro and up); policy detail opens the web.
- API:
GET/POST /api/api-keys,DELETE /api/api-keys/:id,GET /api/api-keys/:id/usage. Key management always needs a signed-in session; a key cannot mint keys.
Scopes
A key needs at least one resource scope:
| Scope | Unlocks |
|---|---|
domains |
Inventory, history, DNS and registrar events, uptime, DMARC reporting, alerts, settings, groups, clients, support threads |
scans |
Domain scans, security checkups, dark-web monitoring, scanner issue reports |
seo |
On-page SEO, whole-site audits, deep crawls, reports, and the entire Local SEO suite |
accessibility |
Audit-grade WCAG evaluations |
vulnscan |
Vulnerability scans, ports, components, ownership verification, lookalikes, watchlist, IP targets |
compliance |
PCI, HIPAA and CMMC control records, incident and WISP records |
status |
Custom endpoint checks and third-party service status |
write |
Required on top of any of the above for anything that changes state. Enterprise only |
Give each key only what it needs; tools outside a key's scopes are never offered and cannot be called. An admin scope exists for the operators' nightly routine and can only be minted from an administrator's own session.
Limits
| Limit | Value |
|---|---|
| Active keys per account | 10 |
| Rate limit | 1,000 requests per hour per key by default; settable from 1 to 10,000 at creation |
| Expiry | Optional; a future date. Expired and revoked keys answer 401 |
| Usage retention | The current hour for limiting, the last 24 hours in the usage view, 30 days stored |
A 429 means the key's hourly limit, or a per-plan manual-scan limit; the response says which and when it resets.
Plan checks
The plan is re-read on every request. A key created on Enterprise loses write the moment the account is Pro; a key on an account that drops below Pro stops working entirely until the plan is back. Keys are never deleted by a plan change.
Revoking
DELETE /api/api-keys/:id revokes immediately. Every creation and revocation is in the audit log.
Common questions
I lost the key. It cannot be shown again. Revoke it and create another.
Can a key reach admin routes? No, except the admin scope's three operator reads, which a customer key cannot carry.
Can I use a key from the browser? Yes, but do not embed it in a public page; it is a credential to your account.
Keep reading
Related articles
- The REST APIBase URL, bearer authentication with an nhm_ key, the domain check endpoint, the resource endpoints behind the dashboard, and the 401, 402, 403 and 429 replies.API and MCP ·Updated
- Connecting the MCP serverAdd https://nhmohio.com/api/mcp to Claude Code, Claude Desktop or any HTTP MCP client with an nhm_ key, confirm what the key can reach, and use the prompts.API and MCP ·Updated
- MCP tool referenceThe 196 tools by family, the scope each needs, and the most useful tools in each with what they return. 104 read, 82 write, 10 destructive.API and MCP ·Updated