---
metadata:
  - name: generator
    content: Diplodoc Platform v5.39.6
alternate:
  - https://yandex.com/dev/commercial/doc/en/concepts/limit.md
  - https://yandex.com/dev/commercial/doc/ru/concepts/limit.md
---
> **Documentation Index:** Fetch the complete configuration index at https://yandex.com/dev/commercial/doc/en/llms.txt

# How to set up API key restrictions

An API key can be linked to domains or IP addresses to restrict requests from other sources. This setting prevents you from using your key in third-party services.

{% note info %}

The restriction only applies to billable requests. The map will appear on another website, but no [billable operations](https://yandex.com/dev/commercial/doc/en/concepts/jsapi-geocoder.md) will work.

{% endnote %}

## What restrictions can apply {#what-limits}

**IP address** — Address of the device the request was sent from.  For requests sent from websites, this is the address of the user's device (not the address of the website hosting server). For requests sent from a server or local device, the IP matches the external address of the server or device.

**Domain** — Domain passed in the `Referer` header of a request. For requests sent from websites, the header is usually specified automatically and matches the page address. Some websites use [containers](#container) or may not send the `Referer`. If a request is sent from a server or local device (for example, using `curl`), you should specify the header yourself.

## How to add settings for API keys {#how-to}

To specify allowed domains and IP addresses for your API key:
- Go to the [Developer Dashboard](https://developer.tech.yandex.ru/).
- Select the key you need and click **Edit**.
- List the IP addresses you can make requests from, one address per line. IPv4, IPv6, and subnets are supported. For example, you can specify addresses this way:

    ```
    192.0.2.0
    192.0.2.0/24
    2001:db8::/32
    ```
    
    {% note info %}
    
    When loading the map, the user's device IP is used. When working with the JSAPI, we recommend using a domain restriction.
    
    {% endnote %}
    
- List the domains that you can make requests from. Domain information is passed in the `Referer` header. Domains are listed one per line, without specifying the port, URL schema, or parameters. The value of the `Referer` header should be a URL (for example, `https://www.yandex.ru`). All subdomains are automatically added to the list of allowed ones. For example, you can specify domains as follows:

    ```
    https://www.yandex.ru
    https://www.yandex.com
    https://www.example.com
    ```

The entered restrictions are applied within 15 minutes of filling out the form.

## How API key restrictions are checked {#how-checked}

Key checks are performed as follows:
- If both the IP address and domain are specified, only **one** value has to match. For example, a user from an unknown IP can use the map on the specified website.
- If only the domain is specified, it must match the `Referer` header.
- If only the IP address is specified, it must match the IP of the request source.
- If the fields are empty, the map can be used on any domain and from any IP.

<!--example>
            <title>Пример проверки ограничений</title>
            <dl>
                <dlentry>
                    <dt/>
                    <dd>
                        <p><b>Указанные ограничения по IP-адресам</b></p>
                        <codeblock>198.51.100.0
192.0.2.0/24</codeblock>
                        <p><b>Указанные ограничения по HTTP Referer</b></p>
                        <codeblock>yandex.ru
maps.yandex.ru</codeblock>
                        <p><b>Примеры валидных запросов</b></p>
                        <p>
                            <ul id="ul_dqt_k3l_kkb">
                                <li>Запросы с IP-адреса <codeph>198.51.100.0</codeph>, в заголовке
                                    Referer которых указан домен <codeph>yandex.ru</codeph>;</li>
                                <li>Запросы с IP-адреса <codeph>198.51.100.0</codeph>, в заголовке
                                    Referer которых указан домен
                                    <codeph>maps.yandex.ru</codeph>;</li>
                                <li>Запросы из подсети с IP-адресом <codeph>192.0.2.0/24</codeph>, в
                                    заголовке Referer которых указан домен
                                        <codeph>yandex.ru</codeph>;</li>
                                <li>Запросы из подсети с IP-адресом <codeph>192.0.2.0/24</codeph>, в
                                    заголовке Referer которых указан домен
                                        <codeph>maps.yandex.ru</codeph>;</li>
                            </ul>
                        </p>
                        <p><b>Примеры невалидных запросов</b></p>
                        <p>
                            <ul id="ul_arl_53l_kkb">
                                <li>Запросы с IP-адреса <codeph>192.0.2.<b>5</b></codeph> с пустым
                                    заголовком Referer;</li>
                                <li>Запросы с IP-адреса <codeph>192.0.2.<b>5</b></codeph>, в
                                    заголовке Referer которых указан домен
                                        <codeph>yandex.<b>com</b></codeph>;</li>
                            </ul>
                        </p>
                    </dd>
                </dlentry>
            </dl>
        </example-->

## How to display a map in a container {#container}

When displaying the map in containers, such as WebView or iframe, the user's device may pass an invalid HTTP referer. Below are recommendations for working with popular containers.

{% cut "iframe" %}

Modern web browsers pass the address of a loaded page in the iframe element. Just specify the domain of the page with the map in the [Developer Dashboard](https://developer.tech.yandex.ru/).

{% endcut %}

{% cut "Android webView" %}

When using webView on Android devices, specify the Referer header via the advanced loadUrl function:

```java
// Website to be loaded into a webView.
String url = "http://www.myserver.com/";

// Map indicating the Referer header.
Map<String, String> headers = new HashMap<String, String>();
headers.put("Referer", "http://www.mymap.com/map.html");

// Loading a webView with required parameters.
WebView wv;
wv = (WebView) findViewById(R.id.webview);
wv.loadUrl(url, headers);               
```

{% endcut %}

{% cut "iOS UIWebView" %}

When using UIWebView on iOS devices, specify the Referer header in a request sent to UIWebView. Do this using the [- setValue:forHTTPHeaderField:](https://developer.apple.com/documentation/foundation/nsmutableurlrequest#//apple_ref/occ/instm/NSMutableURLRequest/setValue%3aforHTTPHeaderField%3a) method. For example, you can specify it as follows:

```objectivec
NSMutableURLRequest* request = ...;
[request setValue:@"https://www.mymap.ru" forHTTPHeaderField: @"Referer"];
```

{% endcut %}