Authentication

API Keys

SimplyPNG uses API keys to authenticate requests. You can create and manage your API keys from the developer console.

Key Types

Using Your API Key

Include your API key in every request using one of three methods:

Method 1: Authorization Header (Recommended)

curl -X POST https://api.simplypng.app/api/v1/jobs \
  -H "Authorization: Bearer sp_test_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image": "https://example.com/photo.jpg"}'

Method 2: X-API-Key Header

curl -X POST https://api.simplypng.app/api/v1/jobs \
  -H "X-API-Key: sp_test_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"image": "https://example.com/photo.jpg"}'

Method 3: Query Parameter

curl "https://api.simplypng.app/api/v1/credits?api_key=sp_test_YOUR_API_KEY"

Note: Query parameter auth is convenient for quick testing (e.g., checking credit balance in a browser). For production use, prefer header-based auth to avoid exposing keys in URLs, logs, and browser history.

Security Best Practices

Error Responses

If authentication fails, you'll receive a 401 error response:

{
  "error": {
    "type": "authentication_error",
    "code": "INVALID_API_KEY",
    "message": "Invalid or expired API key"
  },
  "request_id": "req_1703260800000_a1b2c3d4e5f6"
}

Common Error Codes