Authentication

Creating API Keys

API access is enabled by an active API subscription or a manual Beta grant. Once it is on, you create and delete keys yourself:

1. Start an API subscription from the API pricing section
2. Checkout activates API access automatically
3. Create as many keys as you need from Dashboard → API, and delete any that leak

All keys are prefixed with sk_ for easy identification. Until access is enabled, calls come back 403 api_access_disabled. Extra keys do not raise your rate limit or quota — both are counted per account.

Passing the Key

Send the key as a Bearer token in the Authorization header. This is how the v1 endpoint authenticates every request:

1curl -X POST https://postcapture.com/api/v1/screenshot \
2  -H "Authorization: Bearer $POSTCAPTURE_API_KEY" \
3  -H "Content-Type: application/json" \
4  -d '{"postUrl": "https://x.com/user/status/123"}'

Security Best Practices

• •Use environment variables. Store keys in .env files and load them at runtime.
• •Server-side only. Make API calls from your backend, never directly from the browser.
• •Rotate keys regularly. If a key is compromised, create a replacement in the dashboard and delete the old one. Deleting a key takes effect immediately; your other keys keep working.
• •Use descriptive names. Name keys after the service or environment (e.g., “production-backend”, “staging”).

Authentication Errors

1{
2  "error": "Missing API key. Send it as: Authorization: Bearer sk_...",
3  "code": "missing_api_key"
4}

1{
2  "error": "Invalid API key",
3  "code": "invalid_api_key",
4  "details": "KEY_NOT_FOUND"
5}

1{
2  "error": "API access is not active for this account. Start at https://postcapture.com/screenshot-api#pricing or contact [email protected].",
3  "code": "api_access_disabled"
4}