> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pictify.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Security

> Best practices for managing and securing API keys

# API Key Security

API keys authenticate your requests to the Pictify API. Proper key management is essential for security.

## Key Format

A key is a single secret with full access to your account's (or team's) resources. New keys start with `pic_live_` followed by 64 hex characters; keys created before September 2026 are bare 64-character hex strings and remain valid. There are no key types or sandbox keys — every key is live, and every render it makes consumes your plan's monthly credits.

## Creating API Keys

### Dashboard

1. Open **Settings** in the dashboard
2. Click **New key**
3. Copy the key — the list shows it masked, and the **Copy** button gives you the full value

### Key Properties

Each key includes:

* **Secret** - The key value itself (`pic_live_` + 64 hex characters)
* **Created** - Creation timestamp
* **Last used** - When the API was last called from this account (shared across keys, not tracked per key)

## Storing Keys Securely

### Environment Variables

The recommended approach for most applications:

```bash theme={null}
# .env (never commit this file)
PICTIFY_API_KEY=pic_live_...
```

```typescript theme={null}
// Load from environment
const pictify = new Pictify({ apiKey: process.env.PICTIFY_API_KEY });
```

<Warning>
  Never commit API keys to version control. Add `.env` to your `.gitignore`.
</Warning>

### Secrets Managers

For production environments, use a secrets manager:

#### AWS Secrets Manager

```typescript theme={null}
import { SecretsManager } from '@aws-sdk/client-secrets-manager';

const client = new SecretsManager();
const response = await client.getSecretValue({ SecretId: 'pictify/api-key' });
const apiKey = response.SecretString;

const pictify = new Pictify({ apiKey });
```

#### Google Secret Manager

```typescript theme={null}
import { SecretManagerServiceClient } from '@google-cloud/secret-manager';

const client = new SecretManagerServiceClient();
const [version] = await client.accessSecretVersion({
  name: 'projects/my-project/secrets/pictify-api-key/versions/latest'
});
const apiKey = version.payload.data.toString();
```

#### HashiCorp Vault

```typescript theme={null}
import Vault from 'node-vault';

const vault = Vault({ endpoint: process.env.VAULT_ADDR });
const result = await vault.read('secret/data/pictify');
const apiKey = result.data.data.api_key;
```

### Kubernetes Secrets

```yaml theme={null}
# secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: pictify-credentials
type: Opaque
stringData:
  api-key: pic_live_...
```

```yaml theme={null}
# deployment.yaml
env:
  - name: PICTIFY_API_KEY
    valueFrom:
      secretKeyRef:
        name: pictify-credentials
        key: api-key
```

## Key Rotation

Regularly rotate API keys to limit exposure from potential leaks.

### Rotation Process

1. **Create new key** - Generate a new API key in the dashboard
2. **Update applications** - Deploy the new key to all services
3. **Verify** - Confirm all services are using the new key
4. **Revoke old key** - Delete the old key from the dashboard

### Zero-Downtime Rotation

For production systems, use overlapping validity:

```typescript theme={null}
// During rotation, try both keys
const keys = [
  process.env.PICTIFY_API_KEY_NEW,
  process.env.PICTIFY_API_KEY_OLD
].filter(Boolean);

async function makeRequest(options) {
  for (const key of keys) {
    try {
      const pictify = new Pictify({ apiKey: key });
      return await pictify.renderHtml(options);
    } catch (error) {
      if (error.status === 401 && keys.indexOf(key) < keys.length - 1) {
        continue; // Try next key
      }
      throw error;
    }
  }
}
```

## Access Control

### Principle of Least Privilege

Create separate keys for different purposes:

| Key | Purpose |
| - | - |
| Production key | Production API server |
| Staging key | Staging environment |
| CI key | Automated tests |

Every key has the same full access. Separate keys limit the blast radius of a leak and let you rotate one environment without touching the others; they do not carry different permissions.

### Team Access

* **Limit who can create keys** - Only admins should create production keys
* **Audit key usage** - Monitor which keys are being used
* **Remove departed employees** - Revoke keys when team members leave

## Monitoring & Auditing

### Track Key Usage

The dashboard shows when the API was last called (Settings) and every render the API produced (**Renders**, filtered to the API source). Review it for renders you do not recognise.

### Usage Emails

Pictify emails you when you pass 50% and 90% of your monthly renders. A spike you did not expect is the earliest sign of a leaked key.

## Handling Compromised Keys

If you suspect a key has been compromised:

### Immediate Actions

1. **Revoke immediately** - Delete the key in the dashboard
2. **Create new key** - Generate a replacement
3. **Update services** - Deploy the new key
4. **Review logs** - Check for unauthorized usage

### Investigation

1. **Identify scope** - What data could have been accessed?
2. **Check usage** - Review API logs for suspicious activity
3. **Determine source** - How was the key exposed?
4. **Prevent recurrence** - Implement safeguards

## Security Checklist

* [ ] API keys stored in environment variables or secrets manager
* [ ] `.env` files excluded from version control
* [ ] Separate keys for production and development
* [ ] Keys rotated regularly (at least annually)
* [ ] Unused keys revoked
* [ ] API usage monitored for anomalies
* [ ] Access to key creation restricted
* [ ] Incident response plan documented

## Common Mistakes

### Hardcoding Keys

```typescript theme={null}
// ❌ Never do this
const pictify = new Pictify({ apiKey: 'a3f8c2...' }); // never hardcode

// ✅ Use environment variables
const pictify = new Pictify({ apiKey: process.env.PICTIFY_API_KEY });
```

### Committing Keys

```bash theme={null}
# ❌ This exposes your key
git commit -m "Add API integration"

# ✅ Use .gitignore
echo ".env" >> .gitignore
```

### Sharing Keys in Chat

```
❌ "Here's the API key: a3f8c2d914..."
✅ "I've added the key to the team secrets manager"
```

### Using Production Keys in Development

```bash theme={null}
# ❌ Development with production key
PICTIFY_API_KEY=YOUR_PRODUCTION_KEY npm run dev

PICTIFY_API_KEY=YOUR_DEVELOPMENT_KEY npm run dev
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.