Authentication and API keys

Choose one credential

curl --fail-with-body --silent --show-error \
  "$IMAZEO_API_ORIGIN/v1/projects/$IMAZEO_PROJECT_ID/images?page=1&limit=20" \
  --header "X-API-Key: $IMAZEO_API_KEY"

Create, store and revoke a key

Create a project key in the signed-in Customer portal. The raw value is shown only once; the backend retains a hash. Store the value in a server secret manager or local environment, and use a separate key for each integration you need to revoke independently.

Project key creation and revocation require customer authentication. A key does not create accounts or grant access to other projects. Keys, projects and owner accounts must remain authorized and active for processing.

If a key is exposed, revoke it promptly, issue a replacement and update the integration. Do not paste it into support tickets, query strings, analytics or screenshots.

Keep credentials out of browser code

Do not embed project keys in frontend environment variables, bundles, HTML or public repositories. Route application requests through your own authenticated server. CORS does not make a key safe to publish.

API endpoints return private content after authorization. There are no signed URLs, public delivery URLs or browser-safe anonymous media credentials to substitute here.

Handle expired or revoked access

401 codes include API_KEY_INVALID, API_KEY_REVOKED, AUTH_TOKEN_INVALID and AUTH_TOKEN_EXPIRED. Replace or refresh credentials through the appropriate account flow rather than repeatedly retrying. A 404 can also indicate a scope or ownership mismatch; it does not reveal whether another user owns the resource.

Never send a project key and bearer token together. The media guard rejects that combination as API_KEY_INVALID.