Authenticate requests

Every request to the Bannerify API carries an API key. A key belongs to one workspace. It renders the templates of that workspace, and the generations count toward it.

Create an API key

1. Open the API Keys page in the dashboard.
2. Click New API key.
3. Enter a name and click Create.
4. Copy the key with the Copy key button on its row.

A key is a string of 64 letters and digits. Create one key for each project or workflow, so that you can replace one without touching the others.

Send the key

How you send the key depends on the endpoint.

Endpoints	Where the key goes
createImage, createStoredImage, createPdf, createStoredPdf	apiKey in the JSON body
info, templates, templates/:id	The apiKey query parameter
signedurl	Nowhere. The URL carries apiKeyHashed and sign. See Signed URLs

The API reads the key from the body or the query. It ignores the Authorization header.

curl --request POST \
  --url https://api.bannerify.co/v1/templates/createImage \
  --header 'Content-Type: application/json' \
  --data '{
    "apiKey": "YOUR_API_KEY",
    "templateId": "tpl_xxx"
  }'

An unknown key fails with BAD_REQUEST and the message Invalid api key.

Keep the key safe

Anyone who has your key can generate files that count toward your quota, so keep it on the server.

• Store the key in an environment variable or a secret manager.
• Do not commit it to git, and do not put it in browser code or a mobile app.
• To show a generated image in a browser, build a signed URL on your server. It carries a signature and not the key.

Replace a key

If a key leaks, or you no longer need it:

1. Create a new key.
2. Update your servers and workflows to use it.
3. Delete the old key. Click Delete key on its row on the API Keys page.

A deleted key stops working after a short delay, and so do the signed URLs that it signed.