Get a Moz Links API Key – Help Hub – Moz

What Is a Moz Links API Key?

A Moz Links API key is a private credential that allows an application, script, spreadsheet connector, or reporting platform to request SEO data from Moz programmatically. Instead of manually checking one website at a time in a browser, you can send structured requests and receive structured results.

Depending on the endpoint and your subscription, Moz data can support workflows involving:

• Domain Authority and Page Authority reporting
• Spam Score analysis
• Backlink and linking-domain research
• Anchor-text analysis
• Competitor link-intersection reports
• Top-page discovery
• Link-status monitoring
• Automated SEO dashboards and client reports

Although people commonly call the credential an “API key,” the current Moz interface may describe it as an API token. That distinction matters because a token is normally sent in a request header, while older Moz integrations may expect an Access ID and Secret Key.

Before You Generate a Moz API Token

Create or Sign In to a Moz Account

You need a Moz account before you can activate API access. Use an email address controlled by you or your organization rather than a temporary contractor account. An API integration can remain in production for years, which is considerably longer than some freelance relationships and most office plants.

Confirm That You Need API Access

Moz Pro and the Moz API serve related but different purposes. Moz Pro provides an interface for researching and managing SEO campaigns, while the API is intended for programmatic data retrieval. Do not assume that having access to one product automatically provides the API allowance required by your application.

If your goal is to check a few domains occasionally, a browser-based Moz tool may be enough. The API becomes useful when you need recurring reports, bulk URL processing, custom dashboards, application features, or automated quality checks.

Estimate Your Data Usage

Moz API usage is commonly measured through rows of returned data rather than simply counting button clicks. One URL-metrics result may consume a row, while a backlink request can consume multiple rows because it returns multiple link objects. Certain historical or weighted requests may consume additional quota.

Before choosing a plan, estimate how many domains, URLs, links, and reports you expect to process each month. A script that checks 20 domains once a week has very different requirements from an agency dashboard refreshing 5,000 client URLs every morning.

How to Get a Moz Links API Key

Step 1: Open the Moz Links API Area

Sign in to Moz and navigate to the product area for the Moz Links API. Depending on the current site navigation, you may find it under Products, Moz API, Links API, or a button labeled Get Connected. You may also be directed to the API pricing or signup page.

Moz occasionally reorganizes its navigation, so do not panic if a tutorial’s menu labels do not match yours word for word. The destination you need is the page where API plans or API access can be activated.

Step 2: Select an API Plan

Choose the plan that fits your expected row usage, request frequency, and production needs. Moz may provide a limited testing option, but free-tier allowances, billing requirements, and paid-plan limits can change. Review the live pricing page rather than relying on an old screenshot preserved in a blog post from the geological era of 2021.

For initial development, start with the smallest practical allowance. You can measure actual consumption before upgrading. For production systems, leave room for retries, unexpected traffic, new clients, and reports that someone suddenly decides must refresh every hour.

Step 3: Open the Moz API Dashboard

After activating API access, open your Moz API dashboard. This is where you can typically generate credentials, review existing tokens, remove credentials you no longer need, and inspect account usage.

If the dashboard does not show a token immediately, look for a control such as Create Token, Generate Token, Add Token, or Get a Token.

Step 4: Generate and Name the Token

Create a new API token and give it a descriptive name. A label such as Production Client Dashboard is much more useful than Key 2. Clear names make it easier to identify which integration will stop working when a credential is rotated or deleted.

Useful naming patterns include:

• Local Development
• Staging SEO Dashboard
• Production Reporting App
• Google Sheets Connector
• Agency Client Portal

Use separate tokens for separate environments whenever possible. If a development credential is exposed, you can revoke it without knocking the production dashboard unconscious.

Step 5: Copy and Store the Token Safely

Copy the generated token into a secure password manager, secrets vault, or protected deployment environment. Do not place it in a public document, support ticket, chat room, screenshot, browser-side script, or source-code repository.

Treat the Moz API token like a password with a monthly data allowance attached. Anyone who obtains it may be able to make requests against your account and consume your quota.

Modern Token Authentication Versus Legacy Credentials

This is the part that trips up otherwise competent developers and innocent spreadsheets.

Modern Moz API Token

Modern Moz API documentation uses a single token supplied through an HTTP request header named:

Newer API documentation may use a JSON-RPC endpoint such as:

The request is sent with the POST method, a JSON body, a content-type header, and the private Moz token.

Legacy Access ID and Secret Key

Older Moz Links API tutorials commonly use two values:

• Access ID: Used like a username
• Secret Key: Used like a password

Those credentials may be passed through HTTP Basic Authentication. Some Moz account interfaces can display legacy credentials derived from a newer token for compatibility with existing applications.

Which Method Should You Use?

Use the authentication method shown in the documentation for the specific Moz endpoint or integration you are implementing. Do not paste a single modern token into fields expecting an Access ID and Secret Key. Likewise, do not send two legacy credentials as an x-moz-token value.

When starting a new integration, favor the current token-based workflow. Use legacy credentials only when a trusted application explicitly requires them and its documentation confirms support.

How to Test Your Moz API Token

Test the token before building an entire reporting system around it. A small quota lookup or verification request can confirm that the account, endpoint, headers, and token are working.

Test With cURL

Replace with the token stored in your secure environment. Do not paste a real credential into documentation that will be shared publicly.

Test With Python

This example reads the token from an environment variable instead of embedding it directly in the program. It also sets a timeout and raises an exception when Moz returns an unsuccessful HTTP response.

Test With Postman

1. Create a new request.
2. Change the method to POST.
3. Enter the current Moz API endpoint.
4. Add x-moz-token under Headers.
5. Place your token in the corresponding value field.
6. Add Content-Type: .
7. Select a raw JSON request body.
8. Send the request and inspect the status code and response.

How to Protect Your Moz API Credentials

Keep the Token Out of Source Code

Do not hardcode the token in Python, PHP, JavaScript, configuration examples, WordPress themes, or GitHub repositories. Even deleting it in a later commit may not remove it from Git history.

Use Environment Variables for Development

For local development, place the token in an environment variable or an ignored local configuration file. Confirm that files such as .env appear in .gitignore before the first commit, not after the “why is my credential on the internet?” meeting.

Use a Secret Manager in Production

Production applications should use a dedicated secrets-management service when practical. Cloud platforms provide tools for encrypted storage, access control, auditing, and credential rotation.

Keep Calls on the Server

Do not expose the Moz token in browser JavaScript, a public mobile application, or any client-side bundle. Send user requests to your own secure backend, then let the backend communicate with Moz.

Rotate Exposed Credentials

If a token appears in a public repository, log file, screenshot, or unauthorized system, assume it has been compromised. Generate a replacement, update the application, test the new credential, and revoke the old one.

Common Moz API Key Problems

401 Unauthorized

A 401 response usually means the credential is missing, incorrect, expired, revoked, or supplied using the wrong authentication format. Check for accidental spaces, quotation marks, line breaks, and reversed legacy credentials.

403 Forbidden

A 403 response may indicate that the selected method is unavailable to your account or that the request is not permitted. Confirm your plan, account status, and method name.

429 Too Many Requests

A 429 response means the request exceeds a limit associated with your plan or current request rate. Add caching, batching, delays, and retry logic with exponential backoff rather than immediately resending the same request 300 times with increasing emotional intensity.

400 Bad Request

A 400 response usually points to invalid JSON, missing parameters, unsupported values, malformed URLs, or a request body intended for a different API version.

The Tutorial Uses a Different Endpoint

You may find older examples that call endpoints under:

Newer documentation may use a unified JSON-RPC endpoint instead. Do not mix a modern request body with a legacy endpoint or a legacy authentication method with a modern token-only example.

The Token Works Locally but Fails After Deployment

Confirm that the production environment variable exists, is available to the server process, and does not include hidden whitespace. Also verify that the application is not attempting to read a local .env file that was intentionally excluded from deployment.

Practical Ways to Use Your Moz Links API Key

Once authentication works, start with a small, measurable workflow. Useful beginner projects include a weekly authority report, a spreadsheet enrichment tool, or a dashboard comparing your website with three competitors.

More advanced implementations can identify domains that link to competitors but not to you, monitor changes in high-value backlinks, score outreach prospects, or add SEO metrics to an internal content inventory.

Remember that Domain Authority and Page Authority are comparative Moz metrics, not direct Google ranking factors. They are most useful when comparing similar sites, tracking directional changes, and adding context to link research. A number without a competitor, trend, or business question is merely a number wearing an SEO hat.

Field Notes: Experiences From Real Moz API Setups

The First Challenge Is Usually Product Access, Not Code

In practical integrations, the first delay often occurs before anyone sends an API request. A team member may have a Moz Pro login and assume API access is already active. The developer receives the login, opens the dashboard, and discovers that the relevant API plan still needs to be selected.

The simplest prevention is to separate the checklist into three items: Moz account, API subscription, and API token. Do not mark “credentials ready” until all three have been confirmed.

Old Tutorials Create New Problems

A common experience is finding a perfectly polished tutorial that uses an Access ID, Secret Key, signed expiration timestamp, and an endpoint from a previous API generation. The code may still look convincing because old code does not develop wrinkles.

Before copying an example, compare its endpoint, authentication method, request body, and publication date with the current Moz documentation. If the dashboard gives you one long token but the tutorial asks for two credentials, stop and resolve the version mismatch before debugging anything else.

A Successful Test Should Be Deliberately Boring

For the first request, avoid building a complete backlink crawler with pagination, filtering, database storage, scheduled jobs, and a celebratory Slack notification. Test one authenticated method and print the JSON response.

Once that succeeds, add error handling. Then add storage. Then caching. Then scheduling. Small steps make it obvious which change caused a failure, while giant first attempts produce error messages with the warmth and clarity of an airport departure board during a storm.

Quota Disappears Faster Without Caching

SEO metrics generally do not need to be requested every time a visitor opens a page. Cache results for a reasonable period based on the purpose of the application. An internal report may refresh daily or weekly, while an interactive analysis tool may use a shorter interval.

Also normalize target URLs before querying. Without normalization, your system may separately request data for variations such as example.com, www.example.com, https://example.com/, and https://example.com. Sometimes those distinctions are intentional; sometimes they are four invoices wearing the same trench coat.

Credential Rotation Is Easier With Separate Tokens

Teams that use one credential for local testing, staging, production, spreadsheets, and third-party tools often hesitate to revoke it because nobody knows what will break. Separate, clearly named tokens reduce that risk.

A practical rotation procedure is to create a replacement token, update one environment, test it, deploy it, monitor errors, and only then revoke the old credential. Record the token’s purpose and owner, but never record the secret value in the inventory itself.

The Best Integration Answers a Business Question

It is easy to collect Domain Authority, Page Authority, link counts, anchor text, and Spam Score simply because the API makes them available. A stronger implementation starts with a decision the user needs to make.

For example, an outreach dashboard might ask, “Which uncontacted domains link to at least two competitors, have relevant content, and exceed our minimum authority threshold?” A content report might ask, “Which pages lost valuable links this month and are important enough to reclaim?” Those questions turn API rows into useful work rather than a very expensive digital stamp collection.

Conclusion

To get a Moz Links API key, sign in to Moz, activate the appropriate API plan, open the API dashboard, generate a clearly named token, and store it securely. Use the current authentication method documented for your chosen endpoint, test a small request before building a full integration, and keep credentials out of client-side code and public repositories.

The most important troubleshooting rule is simple: do not mix modern tokens, legacy Access ID and Secret Key credentials, and request examples from different API versions. Once authentication, quota monitoring, caching, and credential management are handled correctly, the Moz API can become a dependable source for automated link research and SEO reporting.