API Authentication & Key Management

Overview

spritesynth's API uses Bearer token authentication via Laravel Sanctum. Each API key grants access to the generation, asset management, and export endpoints. Keys are tied to your account and inherit your subscription's rate limits and credit balance. This guide covers key creation, security best practices, and lifecycle management.

Step 1: Create an API Key

Generate a new key with a descriptive name so you can identify its purpose later:

curl -X POST https://api.spritesynth.com/v1/account/api-keys \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CI/CD Pipeline"
  }'

Important: The full key is only shown once in the response. Copy it immediately — you cannot retrieve it later.

Step 2: Use the Key in Requests

Pass your key as a Bearer token in the Authorization header:

curl -X POST https://api.spritesynth.com/v1/generations/image \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
"prompt": "pixel art sprite, red dragon, fire breath",
    "width": 64,
    "height": 64
  }'

The same header works across all API endpoints. Store the key in an environment variable, never in source code.

Step 3: Revoke a Compromised Key

If a key is exposed, revoke it immediately to prevent unauthorized use:

curl -X DELETE https://api.spritesynth.com/v1/account/api-keys/{key_id} \
  -H "Authorization: Bearer YOUR_API_KEY"

After revocation, any request using that key receives a 401 Unauthorized response. Create a new key to replace it.

Step 4: List and Audit Keys

View all active keys with their last-used timestamps:

curl https://api.spritesynth.com/v1/account/api-keys \
  -H "Authorization: Bearer YOUR_API_KEY"

Audit regularly — remove keys that haven't been used in 90+ days.

Tips

• Use separate keys per environment — A key for development, one for CI/CD, one for production. Revoke individual keys without affecting others.
• Set descriptive names — "Production Web App" is better than "Key 1".
• Rotate periodically — Generate a new key, update your application, then revoke the old one.
• Never commit keys — Use environment variables or a secrets manager. Add .env to your .gitignore.