Authentication
All API requests must include your API key. The Server Monitor API accepts the key in a header.
API key in headers
Use one of the following (we use X-API-Key in all examples):
X-API-Key: <your_api_key>Authorization: Bearer <your_api_key>
Example:
curl -X GET "https://faciotech.com/modules/addons/faciotech_monitor/api.php/status" \
-H "X-API-Key: your_api_key_here"Best practices
Never expose keys in browser apps. Use the API from a backend or a server-side integration so the key is not in client-side code or network tools used by end users.
- Rotate keys regularly. Generate a new key and revoke the old one on a schedule or if compromise is suspected.
- Least privilege. If the dashboard supports scopes or permissions, grant only what you need (e.g. read-only for status pages).
Rate limits
Requests are limited per API key to avoid abuse. Typical limits (check the dashboard or response headers if available):
- Per minute: 60 requests
- Per hour: 1000 requests
When rate limited, the API returns 429 Too Many Requests. Use exponential backoff (e.g. 1s, 2s, 4s) and check for X-RateLimit-Remaining or Retry-After headers.
