Authentication

Last updated: July 13, 2026

ImageGrid uses browser sessions for people and API keys for applications.

Web sessions

Use /app/* for signup, login, email verification, password reset, plan activation, billing, and API-key management. Browser-session endpoints are intentionally excluded from the public OpenAPI specification.

API authentication

Send an API key in either header:

Authorization: Bearer igk_...

or

X-API-Key: igk_...

Automated clients, CLIs, and tools should use a key created by a verified account holder. They do not create accounts or bypass the normal web activation flow.

API key roles

ImageGrid currently defines two machine-credential roles.

api_runtime

Use this for normal application traffic:

• upload assets
• create and poll jobs
• read account identity
• read plan and usage information exposed to the key
• retrieve artifacts while the paid account is active

api_admin

Use this only when an integration needs broader account-management permissions:

• account.read
• api_keys.read
• api_keys.manage
• plans.read
• usage.read

An API role does not replace a signed-in browser session or bypass email verification, billing state, quota enforcement, or service-access checks.

Key issuance guidance

• Create and revoke keys at /app/api-keys.
• Prefer a separate key for each environment or service.
• Use api_runtime unless an integration genuinely needs the broader role.
• Store keys in a server-side secret manager; never ship one in public JavaScript or a mobile bundle.

Rotation guidance

1. Create a replacement key.
2. Deploy it to the application.
3. Confirm traffic uses the replacement.
4. Revoke the old key from /app/api-keys.

Revoked-key metadata remains available for audit and support. The secret itself is shown only once.