Skip to main content

API keys

Every request to the REST API needs an API key. A key acts as the user who made it. It can read and change everything that user can reach through the API. Treat it like a password.

Make a key​

  1. Sign in at app.auto.inc.
  2. Open your Account page.
  3. In API Keys, type a name and click Create API key. Pick a name that tells you where the key lives, such as backup script or home server.
  4. Copy the key right away. Auto stores only a hash of it, so nobody can show it to you again.
Early access

API keys are in early access. If your Account page has no API Keys section, email info@auto.inc to ask for access.

Make one key for each place that uses it. Then you can revoke one place without breaking the others.

Key format​

A key is 40 characters long and starts with ak_live_:

ak_live_3q2-7wJmV0bLx9cKfA1sZpN4rT6yUeHd

The first 16 characters are the key prefix. Your Account page shows the prefix so you can tell keys apart.

Send the key​

Put the key in the Authorization header as a bearer token:

GET /api/ext/v2/info HTTP/1.1
Host: app.auto.inc
Authorization: Bearer ak_live_3q2-7wJmV0bLx9cKfA1sZpN4rT6yUeHd

Auto does not read keys from the URL or the request body in production.

A missing, wrong or revoked key gets this answer:

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{"message": "Unauthorized"}

What a key can do​

Keys have no scopes. Each key can call every endpoint in this API for its owner. A key can never read another user's images or albums.

Keys do not expire. They work until you revoke them.

The same key also works as a bearer token on the MCP server. Most MCP clients should use OAuth instead.

Keep keys safe​

  • Keep keys on a server or in a local environment variable. Never put a key in a web page, a mobile app bundle or a public repository.
  • Browsers can't call the API from other sites. Auto blocks cross-origin requests from origins it does not know. Call the API from your server and pass the results to your page.
  • Signed image URLs in responses work without a key for 15 minutes. You can show them in a browser. They don't expose the key.
  • If a key leaks, revoke it at once and make a new one.

Revoke a key​

  1. Open your Account page on app.auto.inc.
  2. In API Keys, find the key by its name or prefix.
  3. Click Delete.

The key stops working on the next request. Signed image URLs made before you revoked it work until they expire, which takes up to 15 minutes.

When you delete your Auto account, Auto deletes all its keys.