--- title: "IDX Broker API Key Location and Website Handoff Checks" description: "Locate IDX Broker Access Control, distinguish private API credentials from public widgets, and plan a key replacement without hiding dependency failures." canonical: "https://scalewithsearch.com/articles/idx-broker-api-key-location" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # Find and manage an IDX Broker API key for your real estate website In the IDX Broker control panel, open **Home → Access Control** to manage the account's API key. Inspect the existing integration before generating a replacement. The vendor says a new key replaces the existing key. [IDX Broker API Key, public help-center text checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). This guide covers credential ownership, private use, and replacement planning. Use the [WordPress plugin setup guide](/articles/idx-broker-wordpress-plugin-setup) for the IMPress installation workflow. Finding the key does not authorize an account change or grant unrestricted MLS access. ## Where does IDX Broker document the API-key controls? The vendor places them under Home and Access Control in the account control panel. Have the authorized account owner inspect that screen. Keep its secret value out of the repair brief and any public screenshot. [API-key controls, checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). ## Who should retrieve the existing key? Assign the authorized account owner or designated maintainer. Confirm the account identity and intended integration first. Record who can manage the credential without placing the credential itself in the ownership sheet. Give a contractor access through the approved private process for that engagement. ## Should you generate a key because a contractor asks where it is? Inspect the existing key and dependency list first. IDX Broker warns that generating a new key replaces the current value. Treat that action as a planned integration change. [Replacement behavior, checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). ## What happens when the key is revoked? The vendor says tools using it lose API access. Identify those tools before revocation, unless the account owner is responding to an exposure that requires immediate containment. Record the expected interruption and who owns recovery. [Revocation behavior, checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). ## Does the key unlock the entire MLS database? No. IDX Broker limits access to account-associated data and functionality, subject to permissions and platform limits. Ask the developer to identify the exact documented operation needed for the website task. [API scope, checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). ## What can belong in the dependency inventory? List the website plugin, scheduled integration, custom server, or approved third-party tool that uses the credential. Include its owner, purpose, secret-storage location, and acceptance check. Record missing information as **UNRESOLVED**. Avoid copying the secret into the inventory to prove that it exists. ## Is a public listing widget the same thing as an API key? Treat public embed instructions and private API authentication separately. IDX Broker documents API keys in request headers and lists widget information among account API capabilities. Have the implementer identify which integration the page uses before supplying credentials. [API overview, checked 2026.10.22](https://developers.idxbroker.com/idx-broker-api/). ## Should the credential appear in website JavaScript? Keep the account credential out of code delivered to visitors. This is a security recommendation: browser-delivered material is an unsuitable place for a private shared credential. OWASP recommends controlled secret storage and access. Ask the developer to show the private request path with values concealed. [OWASP Secrets Management Cheat Sheet, checked 2026.10.22](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html). ## How does the vendor authenticate an API request? IDX Broker documents an `accesskey` request header. Its header reference also specifies `Content-Type: application/x-www-form-urlencoded`. These are implementation requirements for the developer to verify against the chosen operation. [Request headers, checked 2026.10.22](https://developers.idxbroker.com/idx-broker-api/api-request-and-response-headers/). ## Should a developer put the secret in the request URL? Use the vendor's documented authentication header rather than inventing a URL parameter for the key. Require diagnostic logs to conceal that header's value. Keep the reviewed request shape in the handoff without retaining the live credential. [Authentication headers, checked 2026.10.22](https://developers.idxbroker.com/idx-broker-api/api-request-and-response-headers/). ## What does the ancillary key mean? The vendor describes `ancillarykey` as an optional Developer Partner header. It has a different role from the client account's `accesskey`. Ask the implementer to identify which account each credential represents. [Partner-header definition, checked 2026.10.22](https://developers.idxbroker.com/idx-broker-api/api-request-and-response-headers/). ## Can API version or output settings affect an integration? Yes. IDX Broker documents optional `apiversion` and `outputtype` headers, alongside account preferences. Record the integration's expected format and version without changing them during a key-location check. [Version and output headers, checked 2026.10.22](https://developers.idxbroker.com/idx-broker-api/api-request-and-response-headers/). ## Where should the production secret be stored? Use an approved private configuration or secret-management facility for the receiving system. Limit access to the people and processes that need it. Record how the authorized owner can replace the value. OWASP's guidance supports centralized management, restricted access, and a defined secret lifecycle. [OWASP secret lifecycle, checked 2026.10.22](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html). ## What should a redacted support record contain? Include the operation, integration identity, time, response status, and sanitized error. Omit credentials, lead records, and private request bodies. Ask the developer to show enough information to distinguish authentication from another failure. A screenshot of a key is unnecessary evidence for that diagnosis. ## How should you prepare for a planned replacement? Identify every known consumer of the credential and the person who will update it. Agree on a maintenance window and acceptance checks. Save the current configuration structure with secrets excluded. Because replacement invalidates the previous value, plan recovery around updating dependencies. [Vendor replacement rule, checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). ## Can the old key be assumed available for rollback? No. The documented replacement behavior gives no basis for assuming both values remain valid. Have the owner confirm a recovery procedure before proceeding. Keep credentials out of backups made solely to record the website change. [Key replacement behavior, checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). ## What should the first authorized integration check do? Choose the smallest documented read operation that proves the required connection. Have the implementer record a sanitized result. Exclude lead creation, message sending, and unrelated writes from a credential check. No authenticated operation was performed for this article. ## What website behavior should be checked afterward? Repeat the visitor task supported by the integration. For listing navigation, record the starting page and expected destination. For a plugin, follow its agreed acceptance checklist. Keep a working API response separate from the visible website result, because each establishes a different part of the path. ## Does an API check prove inquiry delivery? Require a separate permitted inquiry test when the integration affects contact handling. Verify the intended recipient receives the matching message. Use the [seller inquiry checklist](/articles/seller-inquiry-path-agent-website) for delivery evidence. A successful authentication result alone cannot establish the recipient's experience. ## What should happen if a key appears in a public file? Notify the authorized account owner through the agreed private channel. Identify the exposed location without copying the value into another public record. Have the owner coordinate containment, replacement, and dependency recovery. OWASP recommends defined rotation and revocation procedures for compromised secrets. [OWASP exposure response, checked 2026.10.22](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html). ## What should a departing contractor hand back? Return the dependency inventory, ownership details, deployment instructions, and sanitized acceptance results. Ask the account owner to review the contractor's remaining access. Plan any credential replacement against the same dependency checks. Do not assume removing a contractor's login updates the tools they configured. ## Who maintains custom API integration code? The vendor's API-key help directs custom application development and troubleshooting to the developer. Name that maintainer in the website scope. Keep vendor-account issues and custom-code repairs separately assigned. [Support boundary, checked 2026.10.22](https://support.idxbroker.com/hc/en-us/articles/34489925449883-API-Key). ## Which account-specific details remain unresolved until inspected? Leave the account permissions, active consumers, approved operations, current error, and private storage arrangement **UNRESOLVED** until the authorized owner confirms them. This article supplies public documentation and a review method. It does not establish that any particular account is connected or approved for a proposed feature. ## What belongs in the real estate website brief? Provide the website URL, intended integration task, account owner, dependency inventory, and sanitized failure through the [real estate website scope](/for/real-estate). Request separate credential, website, and inquiry acceptance checks where relevant. Deliver the secret only through the private process agreed with the authorized implementer. - [IDX Broker custom subdomain and SSL for a real estate agent website](/articles/idx-broker-custom-subdomain-and-ssl) - [IDX Broker dynamic wrappers for real estate agent websites](/articles/idx-broker-dynamic-wrapper) - [IDX Broker forced registration: choose and test the browsing gate](/articles/idx-broker-forced-registration) ## Related: Real estate - [IDX Broker custom subdomain and SSL for a real estate agent website](/articles/idx-broker-custom-subdomain-and-ssl) - [IDX Broker dynamic wrappers for real estate agent websites](/articles/idx-broker-dynamic-wrapper) - [IDX Broker forced registration: choose and test the browsing gate](/articles/idx-broker-forced-registration) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```