IPTrace Console — API documentation

All endpoints accept JSON. Session tokens are short-lived and returned when you sign in; API keys are long-lived and recommended for scripts.

Authentication

• Authorization: Bearer <token> — a session token from POST /console/verify (or the application).
• Authorization: Bearer <ipt_key> or X-API-Key: ipt_key — a personal API key created on the API Keys page.
• API keys are shown once at creation. The server only stores a SHA-256 hash of the key.
• API keys can be revoked at any time; a revoked key stops working immediately.

Endpoints

Method	Path	Auth	Purpose
POST	/console/verify	proof-of-work challenge	Sign in with username/password or a token; returns a session token.
GET	/console/me	session token	Current account, verification status, and usage stats.
GET	/console/confirm?token=	token	Redeem a verification link and mark the account verified.
POST	/console/confirm	session token + challenge	Generate a fresh verification link.
GET/POST	/console/keys	session token	List or create API keys (verified accounts only).
DELETE	/console/keys/:id	session token	Revoke an API key.
GET	/console/api/v1/info	session or API key	Account info plus link/click totals.
GET	/console/api/v1/links	session or API key	Your links with redirect targets and click counts.

Verification

Signups on the application receive a verification link. Open it in this console to confirm your account, or generate a fresh one from the dashboard when logged in. Verified accounts are the ones allowed to create API keys.

• Links expire 48 hours after generation and can be replaced by generating a new one.
• Consuming a link marks the account verified and clears the token so it cannot be reused.

Security and anti-abuse

• Every sensitive endpoint requires a proof-of-work challenge solved by the client (sha256(nonce|ts|proof) beginning with 0000) plus a honeypot field.
• Per-address rate limits: logins 30/10min, verification-link generation 5/3h, API calls 120/min, failed logins lock after 5 tries.
• Passwords are PBKDF2-hashed; sessions are short-lived HMAC tokens; API keys are stored only as hashes.

Examples

// create an API key
const res = await fetch('https://console-iptracker.pages.dev/console/keys', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: 'Bearer ' + sessionToken,
  },
  body: JSON.stringify({ name: 'my script' }),
})
const { data } = await res.json()
console.log(data.token) // ipt_... (shown once)

// call the API with that key
const r = await fetch('https://console-iptracker.pages.dev/console/api/v1/links', {
  headers: { 'X-API-Key': 'ipt_...' },
})
const { data } = await r.json()