Authentication

All API requests (except /health, /status, and /v1/templates) require an API key.

Passing your API key

You can pass your key in one of two ways:

Option 1: Authorization header (recommended)

curl "https://api.snapsharp.dev/v1/screenshot?url=https://example.com" \
  -H "Authorization: Bearer sk_live_YOUR_KEY"

Option 2: X-API-Key header

curl "https://api.snapsharp.dev/v1/screenshot?url=https://example.com" \
  -H "X-API-Key: sk_live_YOUR_KEY"

Both are equivalent. Use whichever fits your stack.

Key format

API keys follow the format sk_live_<48 hex chars>:

sk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4

Security best practices

• Store keys in environment variables: SNAPSHARP_API_KEY=sk_live_...
• Use server-side code to make API calls — never from the browser
• Rotate keys if compromised: generate a new one in your dashboard and deactivate the old

Error responses

Missing or invalid key:

{
  "error": "unauthorized",
  "message": "Invalid or missing API key",
  "status": 401
}