API Key Security

API keys authenticate your requests to the Pictify API. Proper key management is essential for security.

Key Format

An API key is a single 64-character hex string with full access to your team’s resources. There are no key types, prefixes, or sandbox keys — every key is live, and every render it makes consumes your plan’s monthly credits.

Creating API Keys

Dashboard

Go to Settings > API Keys
Click Create Key
Name your key (e.g., “Production Server”, “CI/CD”)
Copy the key immediately - it’s only shown once

Key Properties

Each key includes:

Secret - The key value itself (a 64-character hex string)
Name - Your description
Created - Creation timestamp
Last Used - Last API call timestamp

Storing Keys Securely

Environment Variables

The recommended approach for most applications:

# .env (never commit this file)
PICTIFY_API_KEY=your-64-character-api-key

// Load from environment
const pictify = new Pictify({ apiKey: process.env.PICTIFY_API_KEY });

Never commit API keys to version control. Add .env to your .gitignore.

Secrets Managers

For production environments, use a secrets manager:

AWS Secrets Manager

import { SecretsManager } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManager();
const response = await client.getSecretValue({ SecretId: 'pictify/api-key' });
const apiKey = response.SecretString;

const pictify = new Pictify({ apiKey });

Google Secret Manager

import { SecretManagerServiceClient } from '@google-cloud/secret-manager';

const client = new SecretManagerServiceClient();
const [version] = await client.accessSecretVersion({
  name: 'projects/my-project/secrets/pictify-api-key/versions/latest'
});
const apiKey = version.payload.data.toString();

HashiCorp Vault

import Vault from 'node-vault';

const vault = Vault({ endpoint: process.env.VAULT_ADDR });
const result = await vault.read('secret/data/pictify');
const apiKey = result.data.data.api_key;

Kubernetes Secrets

# secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: pictify-credentials
type: Opaque
stringData:
  api-key: your-64-character-api-key

# deployment.yaml
env:
  - name: PICTIFY_API_KEY
    valueFrom:
      secretKeyRef:
        name: pictify-credentials
        key: api-key

Key Rotation

Regularly rotate API keys to limit exposure from potential leaks.

Rotation Process

Create new key - Generate a new API key in the dashboard
Update applications - Deploy the new key to all services
Verify - Confirm all services are using the new key
Revoke old key - Delete the old key from the dashboard

Zero-Downtime Rotation

For production systems, use overlapping validity:

// During rotation, try both keys
const keys = [
  process.env.PICTIFY_API_KEY_NEW,
  process.env.PICTIFY_API_KEY_OLD
].filter(Boolean);

async function makeRequest(options) {
  for (const key of keys) {
    try {
      const pictify = new Pictify({ apiKey: key });
      return await pictify.renderHtml(options);
    } catch (error) {
      if (error.status === 401 && keys.indexOf(key) < keys.length - 1) {
        continue; // Try next key
      }
      throw error;
    }
  }
}

Access Control

Principle of Least Privilege

Create separate keys for different purposes:

Key Name	Purpose	Access Level
`prod-api-server`	Production API	Full access
`staging-server`	Staging environment	Test key
`ci-cd-pipeline`	Automated tests	Test key
`analytics-readonly`	Metrics collection	Read-only

Team Access

Limit who can create keys - Only admins should create production keys
Audit key usage - Monitor which keys are being used
Remove departed employees - Revoke keys when team members leave

Monitoring & Auditing

Track Key Usage

Monitor your API usage in the dashboard:

Requests per key
Error rates
Last used timestamp
Geographic distribution

Set Up Alerts

Configure alerts for suspicious activity:

Sudden spike in requests
Requests from unexpected locations
High error rates
Usage outside business hours

Audit Logs

Review audit logs regularly:

{
  "timestamp": "2026-01-29T10:30:00Z",
  "action": "api.request",
  "keyId": "key_abc123",
  "endpoint": "/image",
  "method": "POST",
  "status": 200,
  "ip": "203.0.113.50",
  "userAgent": "pictify-node/1.0.0"
}

Handling Compromised Keys

If you suspect a key has been compromised:

Immediate Actions

Revoke immediately - Delete the key in the dashboard
Create new key - Generate a replacement
Update services - Deploy the new key
Review logs - Check for unauthorized usage

Investigation

Identify scope - What data could have been accessed?
Check usage - Review API logs for suspicious activity
Determine source - How was the key exposed?
Prevent recurrence - Implement safeguards

Security Checklist

API keys stored in environment variables or secrets manager
.env files excluded from version control
Separate keys for production and development
Keys rotated regularly (at least annually)
Unused keys revoked
API usage monitored for anomalies
Access to key creation restricted
Incident response plan documented

Common Mistakes

Hardcoding Keys

// ❌ Never do this
const pictify = new Pictify({ apiKey: 'a3f8c2...' }); // never hardcode

// ✅ Use environment variables
const pictify = new Pictify({ apiKey: process.env.PICTIFY_API_KEY });

Committing Keys

# ❌ This exposes your key
git commit -m "Add API integration"

# ✅ Use .gitignore
echo ".env" >> .gitignore

❌ "Here's the API key: a3f8c2d914..."
✅ "I've added the key to the team secrets manager"

Using Production Keys in Development

# ❌ Development with production key
PICTIFY_API_KEY=YOUR_PRODUCTION_KEY npm run dev

PICTIFY_API_KEY=YOUR_DEVELOPMENT_KEY npm run dev

Getting Started

Concepts

Security

Resources

API Key Security

API Key Security

Key Format

Creating API Keys

Dashboard

Key Properties

Storing Keys Securely

Environment Variables

Secrets Managers

AWS Secrets Manager

Google Secret Manager

HashiCorp Vault

Kubernetes Secrets

Key Rotation

Rotation Process

Zero-Downtime Rotation

Access Control

Principle of Least Privilege

Team Access

Monitoring & Auditing

Track Key Usage

Set Up Alerts

Audit Logs

Handling Compromised Keys

Immediate Actions

Investigation

Security Checklist

Common Mistakes

Hardcoding Keys

Committing Keys

Using Production Keys in Development

​API Key Security

​Key Format

​Creating API Keys

​Dashboard

​Key Properties

​Storing Keys Securely

​Environment Variables

​Secrets Managers

​AWS Secrets Manager

​Google Secret Manager

​HashiCorp Vault

​Kubernetes Secrets

​Key Rotation

​Rotation Process

​Zero-Downtime Rotation

​Access Control

​Principle of Least Privilege

​Team Access

​Monitoring & Auditing

​Track Key Usage

​Set Up Alerts

​Audit Logs

​Handling Compromised Keys

​Immediate Actions

​Investigation

​Security Checklist

​Common Mistakes

​Hardcoding Keys

​Committing Keys

​Sharing Keys in Chat

​Using Production Keys in Development

API Key Security

Key Format

Creating API Keys

Dashboard

Key Properties

Storing Keys Securely

Environment Variables

Secrets Managers

AWS Secrets Manager

Google Secret Manager

HashiCorp Vault

Kubernetes Secrets

Key Rotation

Rotation Process

Zero-Downtime Rotation

Access Control

Principle of Least Privilege

Team Access

Monitoring & Auditing

Track Key Usage

Set Up Alerts

Audit Logs

Handling Compromised Keys

Immediate Actions

Investigation

Security Checklist

Common Mistakes

Hardcoding Keys

Committing Keys

Sharing Keys in Chat

Using Production Keys in Development