ARIN now accepts Reg-RWS API keys in a request header

What changed

As part of its 28 July 2026 release, ARIN's Registration RESTful Service (Reg-RWS) began accepting API keys in a request header. ARIN explained the change in an 11 August blog post and repeated the advice in its September roundup: sending the key as a URL query parameter remains acceptable for now, but support for that method will eventually be retired, and ARIN recommends switching. No retirement date has been published.

Why it matters for BYOIP teams

Teams that automate registry records, such as reassignments, point-of-contact data or other registration tasks, often do it through Reg-RWS. Keys in URLs can end up in proxy logs, monitoring tools and shell history, so moving them to a header is a small change with a clear security benefit. This follows a similar credential change at the RIPE NCC (see related story).

What to check

• Search scripts and infrastructure code for Reg-RWS calls that pass the key in the URL (for example an apikey= query parameter).
• Third-party tools and provider integrations that call ARIN on your behalf.
• Logs that may already contain keys; rotate keys if they have been exposed.