Start building with AlexWeb
Anyone can read AlexWeb’s public service information. A developer account gives you a private area for your own resources, events, API keys, OAuth applications, webhooks, schedules, and usage history.
The developer console is the website for managing that access. Your apps connect to the API using an API key or OAuth token. They do not need your console password.
One account. Your own data.
Create an account in the developer console, make a key for your app, and keep track of your requests in one place.
Create an account
1
Open the console
Visit api.alexxweb.com/developers and choose the account creation option.
2
Choose a username and password
Use a username with 3–32 letters, digits, underscores, or hyphens. Usernames are case-insensitive:
MyApp and myapp refer to the same username. Choose a password between 12 and 128 characters. A display name is optional, and no email address is required.3
Create a key for your app
After signing in, open API key management. Give the key a recognizable name, select its permissions and expiry, then save the returned secret privately. See API Keys for the available permissions.
4
Make your first request
Use the key to check your identity, then create a resource. Your new account starts with its own data; examples in the docs do not create resources until you send them.
Sign in later
Open the console and enter the same username and password. A successful login opens a browser session lasting up to 12 hours. When it expires, sign in again. The account supports up to ten browser sessions; starting another session after reaching that number ends the oldest one. The console also supports connecting with an existing API key. This is useful for an existing account or for a key that has access to only part of an account. The console’s available operations follow that credential’s permissions: a read-only key does not become a management key simply because you use it in a browser.Developer account login
Use your username and password to manage your account in the browser. Keep the password private.
API key connection
Use an existing key to access the API operations granted by that key’s scopes.
What you can manage
Creating or rotating a secret shows the new value once. A list of keys or applications shows their identifiers and metadata; it cannot reveal an existing secret.
Keep your apps separate
Your account’s resources, events, applications, keys, and usage belong to your account. A key from another account does not give you access to them. When an app connects through OAuth, it accesses the data belonging to the account that approved it. Use a dedicated key for each app or integration. For example:
Management permissions such as
keys:manage and apps:manage allow changes to credentials and registered applications. Give them to tools that need to manage access.
Understand your allowance
New developer accounts have an allowance of 10,000 authenticated API requests per day, shared across the account’s credentials. Creating another key does not create another daily allowance. The daily allowance resets at midnight UTC. Each API credential also has a 120 request per minute limit. Public requests have a separate 60 request per minute per IP address limit; the legacy/health liveness route is exempt. Use Usage & Limits for response headers and retry behavior.
An API response with HTTP 429 means a request allowance has been reached. Follow Retry-After instead of retrying continuously. A larger number of keys does not bypass the account allowance.
The console’s usage view shows recorded requests for your account. Those statistics are useful for deciding whether your app should cache a value, poll less often, or use events to react to changes.
Change your password
Use the password change form in account settings. Enter your current password and a new password between 12 and 128 characters. A successful change ends your other browser sessions, so other browsers need to sign in again. There is currently no email-based password reset flow. Store your password in a password manager so you can retrieve it later. API keys and client secrets are separate credentials; manage their access in the keys and applications areas.Sign out
Use Sign out in the console to end the current browser session. Closing a tab alone does not immediately expire a browser session. On a shared computer, sign out before leaving it. An API key copied into an app remains usable until it expires, is rotated, or is revoked. Signing out of the console does not replace the need to revoke an app’s key when you want to remove that app’s access.Browser session security
The console uses a session cookie. The hosted service marks it HttpOnly, Secure, and SameSite=Strict. HttpOnly means ordinary page JavaScript cannot read the session cookie; Secure restricts it to HTTPS; SameSite=Strict limits when browsers attach it to requests initiated from other sites. Requests that change account data also use a CSRF token and same-origin checks. The console handles these checks automatically. You do not need to copy session cookies or CSRF values into your apps. Use API keys for your own service, or OAuth when another app should ask for permission.Console API routes
These endpoints support the console. Signup and login accept JSON. Requests that use or change a session rely on that browser’s cookie; state-changing session requests also require the console’s CSRF handling.
These are browser account-management routes. The interactive API panels elsewhere in the docs use API credentials, so they do not require your console password.