Direct access: X-API-Key#
Send your key in the X-API-Key header on each /v1 request. Your account portal supports key creation and revocation subject to its identity verification controls. The secret is shown once at creation; later listings contain identifiers and status.
curl --fail-with-body --get "$IABULA_API_BASE/v1/medications/search" \
--header "X-API-Key: $IABULA_API_KEY" \
--data-urlencode 'q=dipirona' \
--data-urlencode 'limit=20'Marketplace access#
RapidAPI Hub calls use the credentials and headers provided by the marketplace. Do not use your direct IaBula key as a RapidAPI key or send internal gateway secrets. Use the listing's generated integration snippet for your subscription.
Web sessions and API requests#
Login maintains your portal session. The REST API uses separate authentication; a session cookie does not replace an API key. Check your account plan, limits and usage when sizing an integration. Limits depend on plan and channel; there is no universal quota in this guide.
Protect your credentials#
- Use HTTPS and keep the key on your server.
- Do not include keys in URLs, logs, screenshots, commits or public JavaScript.
- If a key is exposed, revoke it and update your integration.
- Never share infrastructure secrets or try to authenticate through internal gateway headers.