Make the Switch to More Secure API Key Handling for Reg-RWS
ARIN’s Registration RESTful Service, or Reg-RWS, allows users to interact with ARIN’s database securely and efficiently by automating registration tasks instead of manually updating records in ARIN Online. Common uses include managing Resource Public Key Infrastructure (RPKI) and Internet Routing Registry (IRR) records, processing reassignments and reallocations, and updating net blocks.
New to Reg-RWS? Our Reg-RWS Basics post walks through the fundamentals, including creating and managing your API key.
As part of our 28 July 2026 release, ARIN now allows RESTful calls using the more secure method of sending the API key in a header. While it remains acceptable to send an API key as a query parameter in the URL, support for this method will eventually be retired, and we strongly recommend switching to the new method now.
Why Make This Change?
On the surface, both approaches accomplish the same goal: The server receives the API key and authenticates the request. The difference lies in what happens around the request.
If your API key is included as a query parameter in the URL, it could end up stored in browser history, server logs, and proxy logs outside of your application. Anyone with access to those logs could have access to your credentials. By contrast, placing the API key in an HTTP header significantly reduces the chance of accidental exposure.
There’s also a structural argument for the change: A RESTful URL should identify the resource being requested, not who is requesting it. Authentication is metadata about the request, not part of the resource. Additionally, editing URLs for various calls may be quicker and easier with one less variable to manage.
For more on keeping your API key secure — including why you should never share one key across a team — read the blog post “Smart API Key Management for Teams.”
How It Works
Previously, ARIN’s documentation presented examples of transaction URLs like this:
URL: /rest/poc/POCHANDLE?apikey=APIKEY
This is the structure for getting information about a Point of Contact from ARIN’s database. The URL is presented with two query parameters: the POCHANDLE of the Point of Contact and the API key.
Now we recommend removing the “?apikey=APIKEY” portion of the URL and sending the API key as a header through your management software of choice. An example of the new structure looks like this:
URL: /rest/poc/POCHANDLE
Authorization Header Name: Authorization
Authorization Header Value: ApiKey ‘apikey’ (e.g. ApiKey API-xxxx-xxxx-xxxx)
In your management software, the field header name will be entered as “Authorization,” and the header value will be entered as “ApiKey API-xxxx-xxxx-xxxx.” Your management software should have its own documentation regarding its specific processes.
The Bottom Line
Authentication belongs in headers, where it is easier to protect, easier to manage, and easier for infrastructure to understand. Keeping credentials out of URLs reduces the risk of accidental exposure, aligns with industry standards, and simplifies how you manage your resources.
Additional information can be found in ARIN’s Reg-RWS Quick Start Guide, the Restful Methods page, and the RPKI and IRR API documentation.
Need Help? If you have questions about API keys or Point of Contact management or need assistance with any registration processes, please contact ARIN’s Registration Services Department by creating an Ask ARIN ticket from your ARIN Online account or by calling our Help Desk at +1.703.227.0660, Monday through Friday, 7:00 AM to 7:00 PM ET.
Recent blogs categorized under: Tips
- Your Number Resource Record Is a Part of the Internet's Infrastructure — Respect It Like One
- ARIN Has a Testing Environment — and Most People Don't Know About It
- Everything 8.3 & 8.4 Transfer Source and Recipient Organizations Need to Know
- Networking with Purpose: Reflections on Engineering the Internet's Future
GET THE LATEST!
Sign up to receive the latest news about ARIN and the most pressing issues facing the Internet community.
SIGN ME UP →Blog Categories
Tips • Training • Caribbean • IPv6 • Data Accuracy • IPv4 • Guest Post • Fellowship Program • ARIN Bits • Elections • Customer Feedback • Outreach • Internet Governance • Public Policy • RPKI • Grant Program • Updates • Security • IRR • Business Case for IPv6
