Authentication
The render API authenticates with an API key passed in the x-api-key header. Dashboard and account endpoints use a session JWT instead. Every request must be authenticated — there are no anonymous renders.
API keys
Send your key in the x-api-key header on every render request:
curl https://api.renderkit.tech/v1/screenshot \
-H "x-api-key: rk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6" \
-H "Content-Type: application/json" \
-d '{ "url": "https://stripe.com" }'Keep keys server-side
An API key carries your full plan and quota. Never ship it to a browser or mobile app — proxy renders through your backend. A leaked key can spend your credits.
Sandbox vs. live keys
| Prefix | Plan | Use for |
|---|---|---|
rk_sandbox_… | sandbox | Local dev and testing against your one-time free credits. |
rk_live_… | paid (hobby / growth / business) | Production traffic billed against your monthly quota. |
A key's tier is fixed to your plan at creation. When you upgrade or downgrade, existing keys are automatically re-tiered — you don't need to rotate them to change limits.
Managing keys
Create, list, and revoke keys from the dashboard or the account API. The plaintext value is returned once at creation; only its hash and a short display prefix are stored.
curl https://api.renderkit.tech/v1/keys \
-H "Authorization: Bearer $JWT" \
-H "Content-Type: application/json" \
-d '{ "name": "production" }'Authentication errors
| HTTP | Code | Cause |
|---|---|---|
| 401 | INVALID_API_KEY | A supplied x-api-key is malformed, expired, or revoked. |
| 401 | INVALID_TOKEN | No x-api-key header at all, or an expired dashboard JWT. |
| 403 | ACCOUNT_SUSPENDED | The account behind the key is suspended. |