Authentication

All API requests require authentication using an API key. This page explains how to create and use API keys.

Creating an API key

1. Sign in to the AllScreenshots dashboard
2. Navigate to API Keys in the sidebar
3. Click Create API Key
4. Give your key a descriptive name (e.g., "Production", "Development")
5. Copy the key immediately—it won't be shown again

Using your API key

Include your API key in the Authorization header with a Bearer prefix:

curl -X POST 'https://api.allscreenshots.com/v1/screenshots' \
  -H 'Authorization: Bearer sk_live_abc123...' \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://example.com"}'

Key prefixes

API keys have prefixes to indicate their type:

Security best practices

Follow these practices to keep your keys secure:

Use environment variables

Store keys in environment variables, not in code:

# .env file (never commit this)
ALLSCREENSHOTS_API_KEY=sk_live_abc123...

// Access via environment variable
const apiKey = process.env.ALLSCREENSHOTS_API_KEY;

Use server-side requests only

Always make API calls from your server, never from the browser:

// Good: Server-side API route
app.post('/api/screenshot', async (req, res) => {
  const response = await fetch('https://api.allscreenshots.com/v1/screenshots', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.ALLSCREENSHOTS_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ url: req.body.url }),
  });
  // ...
});

Rotate keys regularly

Periodically create new keys and delete old ones, especially if:

• A team member leaves your organization
• You suspect a key may have been exposed
• You haven't rotated keys in several months

Use separate keys for environments

Create different keys for development, staging, and production:

• Easier to track usage per environment
• Limits blast radius if a key is compromised
• Allows different rate limits per environment

Managing API keys

From your dashboard, you can:

• View all keys: See key names and creation dates
• Delete keys: Revoke access immediately
• Track usage: Monitor requests per key (coming soon)

Error responses

If authentication fails, you'll receive a 401 Unauthorized response:

{
  "error": "unauthorized",
  "message": "Invalid or missing API key"
}

Common causes:

• Missing Authorization header
• Missing Bearer prefix
• Invalid or revoked API key
• Key from wrong organization

Rate limits

API keys are subject to rate limits based on your plan. See Rate limits for details.