Authentication

Every API request must be authenticated with an API key tied to your account.

Getting your key

Log in and go to My Account → API Key. Click Generate. Save the key somewhere safe - it's shown in full only once. You can revoke and regenerate it at any time from the same page.

Sending the key

Include the key in the X-Api-Key header (recommended):

X-Api-Key: your_api_key

Alternatively, you can send it as a query parameter (useful only for quick testing):

GET /api/uploads?api_key=your_api_key

Security: Never include your API key in public source code, open repositories, or URLs that appear in server logs. Use environment variables or a secrets manager.

Error responses

Code	Meaning
401	Missing or invalid key
403	Account suspended, or the requester's IP is not on the allow list

IP allow list

For additional security, you can restrict your API key to specific IP addresses or CIDR ranges. Configure this from My Account → API Key. If a list is set, any request coming from an IP not on it will immediately receive a 403 response.

Best practices

• Treat your API key like a password.
• Revoke it immediately if you suspect it's been compromised.
• Each account has a single active key - revoking it invalidates all existing integrations until a new one is generated.