Your License Key and the VerifyFiltering API

The "API & Access Management" page in your dashboard isn't a place to create or manage separate API keys — there's only one credential, your license key, and this page shows it to you along with a reference for using it.

There's no key to create, rotate, or revoke yourself

Your license key is unique to your account and doubles as your API credential — it's the exact same Bearer token your installed agent already uses for every call it makes to register a device and report scan results, so calling the API directly means using a credential you already have. There's no self-service way to generate a new one, and no create/rotate/revoke controls anywhere on the page. If your key is ever compromised, rotating it means contacting support.

The key works as a Bearer token against five endpoints

Every API request follows the same pattern — an Authorization: Bearer [LICENSE_KEY] header against https://your-domain/api/agent/ — and the page documents five endpoints, each with a live example you can copy directly:

• Config — inspect your current detection settings: categories, threshold, scan interval, sinkhole IPs, block-page keywords.
• Heartbeat — register a device; the device ID you choose becomes its permanent identifier in your dashboard.
• Results — submit scan results for a device; the server scores each category and flags anything below your passing threshold.
• Check — poll for an on-demand scan request queued from the dashboard (the installed agent already does this automatically every 30 seconds).
• Download — download a pre-built agent binary for your platform; the key is verified on first run, so the binary ties itself to your account.

Only Billing (and the owner) can see any of this — not Admin

The API Keys page, and your account's Usage page alongside it, are both gated behind the Billing permission. Of the four team roles, only Billing holds it — Admin, Technician, and Viewer cannot open either page, and are sent straight back to the dashboard if they try. This is easy to get backwards: "Admin" sounds like it should mean broader access than Billing, but on these two pages, it means none at all.

Your Profile page shares the same gate but handles it differently — instead of redirecting a non-Billing team member away, it still renders the page with their own local username and email, and simply hides the Stripe-sourced sections (name, address, business info) behind a short message explaining they're not available for that role.

Usage: a paused device still counts against your device limit

The Usage page's device count adds active and paused devices together against your plan's limit — pausing a device doesn't free up a slot to register another one. The "Scans This Month" figure and its 12-month history count real scan events (one device, one scan), not the larger number of underlying database rows a single scan actually writes — worth knowing if you're ever comparing this number against something else in the dashboard.

Profile is a read-only summary, not an editable page

Your Profile page displays your name, business details, and address, all sourced live from your Stripe billing information — there's nothing to edit here directly. To change any of it, use "Edit in Stripe," which opens the same Stripe customer portal covered elsewhere. Your username is the one thing shown that comes from your VerifyFiltering account rather than Stripe, and it isn't editable from this page either.