Two endpoints. One of them is the product.

# header on every /api/validate call
Authorization: Bearer ibn_test_9f2a…_4c1b…

Get a key

Sign in at the dashboard: your account starts on the free plan. Create a key there, one per app if you like, and copy it: it is shown only once. Revoke a key from the same page; it stops working at once.

An AI agent gets its key without the dashboard, through the Rose for Agents connector. See For AI agents. Without the connector, an agent can start a trial itself: auth.md.

POST /api/validate

Validate one IBAN. Whitespace and case are normalised for you.

# request
curl -X POST https://ibanly.app/api/validate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input": {"iban": "GB82 WEST 1234 5698 7654 32"}}'

# 200 OK — valid
{
  "output": {
    "iban": "GB82WEST12345698765432",
    "valid": true,
    "country": "GB",
    "check_digits": "82",
    "bban": "WEST12345698765432",
    "formatted": "GB82 WEST 1234 5698 7654 32",
    "reason": null,
    "note": null
  },
  "usage": { "used": 1, "limit": 100 }
}

# 200 OK — invalid (a swapped digit)
{
  "output": {
    "iban": "GB28WEST12345698765432",
    "valid": false,
    "country": "GB",
    "check_digits": "28",
    "bban": "WEST12345698765432",
    "reason": "checksum failed (mod 97)"
  },
  "usage": { "used": 2, "limit": 100 }
}

A well-formed IBAN whose country is outside the length table still gets checksum-validated, with a note that the length was not checked.