# Authentication

Source: https://docs.screenshotlens.com/docs/api/authentication
Summary: Authorize capture requests with API keys created in the dashboard.

## Authorize a request

Pass the key as the `api_key` query parameter.

```bash
curl -G "https://api.screenshotlens.com/v1/screenshots" \
  --data-urlencode "url=https://example.com" \
  --data-urlencode "api_key=YOUR_API_KEY" \
  --data-urlencode "response_type=json"
```

A missing or invalid key returns `401 Unauthorized` with an empty body.

Requests made from a signed-in dashboard session are authorized by the session cookie, so the Playground works without a key.

## Manage keys

Create, rename, and revoke keys under **API keys** at [app.screenshotlens.com](https://app.screenshotlens.com). The dashboard calls these endpoints, which require a session rather than an API key:

| Method   | Path                | Purpose      |
| -------- | ------------------- | ------------ |
| `GET`    | `/v1/api-keys`      | List keys    |
| `POST`   | `/v1/api-keys`      | Create a key |
| `PUT`    | `/v1/api-keys/{id}` | Rename a key |
| `DELETE` | `/v1/api-keys/{id}` | Revoke a key |

## Key hygiene

* Use separate keys for production, staging, CI, and internal tools.
* Rotate a key when ownership changes or when it may have been exposed.
* Store production keys in server-side environment variables or a secret manager.
* Never ship a production key in frontend code.

[API Keys](https://docs.screenshotlens.com/docs/dashboard/api-keys) walks through creating and rotating keys in the dashboard.