Access-controlled integration
Create the key inside your account and use it only from a trusted server. Separate daily limits keep programmatic traffic independent from manual lookup, while the IP allowlist restricts the environments that may send requests.
Starter: up to 2,000 BINs per day
Pro: up to 5,000 BINs per day
Enterprise: up to 15,000 BINs per day
A safer integration pattern
Keep the API key in an environment secret and call BINchek from your backend. Return only the fields your client needs. Never place the key in a URL, browser JavaScript, a mobile build, a public repository or application logs.
Send only a BIN/IIN prefix, never a full PAN
Handle limits and temporary failures without infinite retries
Use separate keys for production and test environments
Frequently asked questions
Is API access included in a web subscription?
No. API access uses a separate subscription and a separate daily limit.
Can I embed the key in my website?
Not in a public frontend. Use your own backend or a serverless function so the key cannot be extracted from browser code.
Ready to test a real workflow?
Create an account, review the available features and confirm the plan terms before payment.