Authentication
Every request needs your API key. Both endpoints accept it in any of the ways below, so you can keep the style your current integration uses.
Ways to send the key
| Method | Example | Typical for |
|---|---|---|
| Basic authentication | user api, password = your key | PDFShift clients |
X-API-Key header | X-API-Key: sk_live_... | Any client |
access_key query parameter | /take?access_key=sk_live_...&url=... | ScreenshotOne clients |
X-Access-Key header | X-Access-Key: sk_live_... | Any client |
| Bearer token | Authorization: Bearer sk_live_... | Any client |
A missing or wrong key returns 401 with {"success": false, "error": "Invalid or missing API key"}.
Keep the key on your server
- Call the API from your backend, never from a browser or a mobile app. Anyone who can see the key can spend your renders.
- Prefer a header over the
access_keyquery parameter where you can. Query strings tend to end up in proxy logs, browser history and error trackers on your side. The Sahifa server itself never logs query strings. - Store the key in an environment variable or a secrets manager, not in the repository.
- If a key may have been exposed, write to support@sahifa.dev and it will be replaced.
Testing without a key
The demo on the home page uses the same renderer, limited to one page, a watermark and a few tries per hour.