API Keys Overview

Creating an API Key#

1. Navigate to API Keys from the sidebar
2. Click Create API Key
3. Enter a descriptive name (e.g., "Production Server", "Development", "Marketing Automation")
4. Select the permissions for this key
5. Click Create

Important: The full API key is shown only once after creation. Copy it immediately and store it securely. You won't be able to see the full key again.

Key Types#

Type	Description	Use Case
Master	Full access to all operations	Admin or owner access
Project	Access scoped to specific templates	Production applications
Read-only	Can only read templates, not render	Listing templates or metadata
GET	Dynamic image URLs only (prefix: rs_get_)	Front-end/public image embedding

GET Keys#

GET keys are designed specifically for the Dynamic Image URLs feature. They:

• Can only access the GET /api/v1/render endpoint
• Are safe to expose in front-end code (HTML, email templates, etc.)
• Require at least one Allowed Host to be configured
• Are rate-limited (60 requests/minute per key, 30/minute per IP)

<img src="/api/v1/render?apiKey=rs_get_...&template=social-card&title.text=Hello" />

Using API Keys#

POST Endpoints (Master, Project, Read-only keys)#

Include your API key in the Authorization header of every API request:

curl -X POST https://your-app.replit.app/api/v1/renders/sync \
  -H "Authorization: Bearer rs_XXXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{ "template": "my-template" }'

GET Endpoint (GET keys)#

Pass the API key as a query parameter:

GET /api/v1/render?apiKey=rs_get_XXXXX&template=my-template&title.text=Hello

See Dynamic Image URLs for full documentation.

Managing Keys#

Viewing Keys#

The API Keys page shows all your keys with:

• Key name and type
• Creator name (visible to owners and admins for all org keys)
• Creation date
• Last used date
• Active/revoked status

Owners and admins see all API keys across the organization with the creator's name displayed. Regular users see only their own keys.

Revoking Keys#

To revoke a key that's been compromised or is no longer needed:

1. Find the key in your API Keys list
2. Click the Revoke button

Revoked keys immediately stop working. Any API requests using a revoked key will receive a 401 Unauthorized error.

Deleting Revoked Keys#

Once a key has been revoked, you can permanently delete it to remove all record of it:

1. Find the revoked key (shown with a red "Revoked" badge)
2. Click the Delete button
3. Confirm the deletion in the dialog

Warning: Deletion is permanent and cannot be undone. The key record is completely removed from the database.

Security Best Practices#

1. Never expose Master/Project/Read-only keys in client-side code — These keys should only be used server-side. Use GET keys for front-end embedding.
2. Use separate keys per environment — Create different keys for development, staging, and production
3. Rotate keys regularly — Periodically create new keys and revoke old ones
4. Use least privilege — Choose the most restrictive key type that meets your needs
5. Monitor usage — Check the "Last Used" date to identify unused keys for cleanup
6. Configure Allowed Hosts for GET keys — Always restrict GET keys to specific domains via the Allowed Hosts setting