API and MCP
API keys
Create scoped nhm_ keys under Settings: resource scopes, the Enterprise-only write scope, optional expiry, the hourly rate limit, ten active keys, and usage.
Updated · 2 min read
An API key is a bearer token of the form nhm_ followed by 64 hex characters. It is shown once at creation and stored hashed; the dashboard shows only its prefix afterwards.
Where
- Web: Settings, API keys; or API keys in the account menu (your initials, top right).
- iOS: Account, Settings, API keys (Pro and up); policy detail opens the web.
- API:
GET/POST /api/api-keys,DELETE /api/api-keys/:id,GET /api/api-keys/:id/usage. Key management always needs a signed-in session; a key cannot mint keys.
Scopes
A key needs at least one resource scope:
| Scope | Unlocks |
|---|---|
domains |
Inventory, history, DNS and registrar events, uptime, site checks, DMARC reporting, alerts, settings, groups, clients, support threads, and what the account may scan |
scans |
Domain scans, on-demand quick and full scans, security checkups, dark-web monitoring, scanner issue reports |
seo |
On-page SEO, whole-site audits, deep crawls, reports, and the entire Local SEO suite |
accessibility |
Audit-grade WCAG evaluations |
vulnscan |
Vulnerability scans, ports, components, ownership verification, lookalikes, watchlist, IP targets |
compliance |
PCI, HIPAA and CMMC control records |
status |
Third-party service status |
write |
Required on top of any of the above for anything that changes state. Enterprise only |
Give each key only what it needs; tools outside a key's scopes are never offered and cannot be called. An admin scope exists for the operators' nightly routine and can only be minted from an administrator's own session.
Limits
| Limit | Value |
|---|---|
| Active keys per account | 10 |
| Rate limit | 1,000 requests per hour per key by default; settable from 1 to 10,000 at creation |
| Expiry | Optional; a future date. Expired and revoked keys answer 401 |
| Usage retention | The current hour for limiting, the last 24 hours in the usage view, 30 days stored |
A 429 means the key's hourly limit, or a per-plan manual-scan limit; the response says which and when it resets.
Plan checks
The plan is re-read on every request. A key created on Enterprise loses write the moment the account is Pro; a key on an account that drops below Pro stops working entirely until the plan is back. Keys are never deleted by a plan change.
Revoking
DELETE /api/api-keys/:id revokes immediately. Every creation and revocation is in the audit log.
Common questions
I lost the key. It cannot be shown again. Revoke it and create another.
Can a key reach admin routes? No, except the admin scope's operator routes under /api/admin/ops, which a customer key cannot carry.
Can I use a key from the browser? Yes, but do not embed it in a public page; it is a credential to your account.
Keep reading
Related articles
- The REST APIBase URL, bearer authentication with an nhm_ key, the routes a key can reach and the scope each needs, which calls need write, and the 401, 402, 403 and 429 replies.API and MCP ·Updated
- Connecting the MCP serverAdd https://nhmohio.com/api/mcp to Claude Code, Claude Desktop, Cursor, VS Code, Codex or any HTTP MCP client with an nhm_ key, keep the key to the job, confirm what it can reach, and use the prompts.API and MCP ·Updated
- MCP tool referenceAll 233 tools a customer key can be offered, by scope, with each one's access level. 125 read, 99 write, 9 destructive; 7 spend credits.API and MCP ·Updated