Authentication

Every request to /api/v1 must be authenticated, except HMAC-signed fetches:

• GET /api/v1/img/{template}?sig= — unauthenticated image fetch for CMS / Open Graph
• GET /api/v1/renders/{id}/asset?sig= — unauthenticated asset stream

Minting a signed URL still needs an API key (POST /api/v1/img/sign). See URL rendering.

Base URL

All examples use this origin: https://app.jsontoimg.com

Paths in this docs site are relative to that host (for example /api/v1/render).

API key (recommended)

Create a key in the dashboard under Integrations → API keys. Send it as either:

Authorization: Bearer sk_...

or:

X-Api-Key: sk_...

Keys are hashed at rest. Revoked or missing keys return 401. Keys authorize /api/v1 and /mcp only; dashboard routes need a session.

Session cookie (browsers)

If you are signed into the dashboard on the same origin, your session cookie can authorize browser calls (for example SSE from the app UI). Prefer API keys for scripts, servers, and third-party backends.

How auth is resolved

1. Valid HMAC sig on GET /img/{template} or GET /renders/{id}/asset → stream the asset (no API key).
2. Valid session cookie → authorize as that user.
3. Otherwise require Authorization: Bearer or X-Api-Key.
4. Lookup the key by prefix and hash; reject if missing or revoked.
5. Otherwise authorize as the key owner.