# Authenticate requests

> Learn how to create an API key and send it with requests to the Bannerify API.

Canonical: https://bannerify.co/docs/api-reference/authentication

Every request to the Bannerify API carries an API key. A key belongs to one workspace. It renders the templates of that workspace, and the generations count toward it.

## Create an API key

1. Open the **API Keys** page in the dashboard.
2. Click **New API key**.
3. Enter a name and click **Create**.
4. Copy the key with the **Copy key** button on its row.

A key is a string of 64 letters and digits. Create one key for each project or workflow, so that you can replace one without touching the others.

## Send the key

How you send the key depends on the endpoint.

| Endpoints | Where the key goes |
| --- | --- |
| `createImage`, `createStoredImage`, `createPdf`, `createStoredPdf` | `apiKey` in the JSON body |
| `info`, `templates`, `templates/:id` | The `apiKey` query parameter |
| `signedurl` | Nowhere. The URL carries `apiKeyHashed` and `sign`. See [Signed URLs](https://bannerify.co/docs/essentials/signed-urls) |

The API reads the key from the body or the query. It ignores the `Authorization` header.

```bash
curl --request POST \
  --url https://api.bannerify.co/v1/templates/createImage \
  --header 'Content-Type: application/json' \
  --data '{
    "apiKey": "YOUR_API_KEY",
    "templateId": "tpl_xxx"
  }'
```

An unknown key fails with [`BAD_REQUEST`](https://bannerify.co/docs/api-reference/errors/code/BAD_REQUEST) and the message `Invalid api key`.

## Keep the key safe

Anyone who has your key can generate files that count toward your quota, so keep it on the server.

- Store the key in an environment variable or a secret manager.
- Do not commit it to git, and do not put it in browser code or a mobile app.
- To show a generated image in a browser, build a [signed URL](https://bannerify.co/docs/essentials/signed-urls) on your server. It carries a signature and not the key.

## Replace a key

If a key leaks, or you no longer need it:

1. Create a new key.
2. Update your servers and workflows to use it.
3. Delete the old key. Click **Delete key** on its row on the **API Keys** page.

A deleted key stops working after a short delay, and so do the signed URLs that it signed.

## Related

- [Previous: API reference](https://bannerify.co/docs/api-reference/overview)
- [Next: Handle errors](https://bannerify.co/docs/api-reference/errors/introduction)
- [Documentation index](https://bannerify.co/docs/llms.txt)