Authentication

Create an API key in your InsuredSpeaks account, then use it to authenticate requests from your integration.

Get your API key

1. Open API keys and sign in to your InsuredSpeaks account.
2. Select Create key and give it a name you will recognize.
3. Copy the key and store it securely. The full key is shown only once.

Create and manage keys in the portal. Your integration uses those keys to call the API.

Authenticate a request

Set API_KEY in your server environment and send the key in the X-API-Key header.

curl https://api.insuredspeaks.com/v1/policies \
  -H "X-API-Key: $API_KEY"

The same key can access your personal portfolios:

curl https://api.insuredspeaks.com/v1/portfolios \
  -H "X-API-Key: $API_KEY"

A key belongs to its creator. On portfolio endpoints, it can read and modify its owner's portfolios, family names, and policy numbers. Keys do not provide separate portfolio scopes or delegated access to another user's data.

The API also accepts Authorization: Bearer isp_.... Send only one authentication header; portfolio requests containing both Authorization and X-API-Key return 400. HTTP Basic authentication is not supported.

Manage and replace keys

Use API keys to view key names, status, creation dates, and last-used dates. You can rename a key or revoke it when it is no longer needed. Full keys cannot be retrieved later.

To replace a key, create a new one, update your integration, and then revoke the old key. Revocation permanently removes access for future requests using that key.

Keep keys private

Store keys in your server's environment or secret store. Do not include them in browser bundles, query strings, source control, or logs. If a key is exposed, revoke it and create a replacement.

Missing, invalid, or revoked keys return 401. A portfolio belonging to another account returns 404. Rate-limited requests return 429; use the X-RateLimit-* response headers to inspect your limit. See Portfolios for ownership behavior and examples.