Skip to main content

Authentication

API key (X-API-Key)​

Most /v1/* routes expect an API key in the X-API-Key header. Exceptions:

  • POST /v1/billing/checkout and POST /v1/billing/portal accept either Authorization: Bearer <access_token> or X-API-Key. With a Bearer token, the JSON body must also carry "currentPassword": billing changes made from a signed-in session ask for the password again. With X-API-Key nothing changes.
  • GET /v1/usage and GET /v1/analytics/usage also accept either Bearer JWT or X-API-Key, so the dashboard can read usage without exposing the raw key.
  • /v1/public/visitor-counter routes are public and gated by server config, not by an API key.
  • POST /v1/billing/webhook is public at the HTTP auth layer but requires a valid webhook signature.
curl https://api.scrift.app/v1/catalog/stripe \
  -H "X-API-Key: YOUR_API_KEY"

How to get a key​

Register at scrift.app. Your key is shown once in the dashboard after registration or regeneration. If you lose it, generate a new key from the dashboard.

Rate limits​

Daily quotas depend on your plan. See Rate limits for tiers and HTTP 429 behavior.

JWT (account endpoints)​

User account routes under /auth/* may require a bearer token where the OpenAPI operation says so, for example:

Authorization: Bearer <access_token>

Access tokens last 15 minutes. The dashboard at scrift.app keeps its session in a secure, HttpOnly cookie that scripts cannot read, so no token is stored in the browser. A session ends after 7 days without use, and in any case 30 days after signing in. Signing in on another device does not end your other sessions; the dashboard's Sign out everywhere does.

Some account actions ask for your password again even while you are signed in: regenerating the API key (POST /auth/regenerate-key), signing out everywhere (POST /auth/logout-all) and the billing routes above. Send it as "currentPassword" in the JSON body; a wrong one returns 401 invalid_credentials.

If you only call catalog/search/SVG/PNG/WebP/brand/subscription APIs from your backend with an API key, you do not need JWT.

Errors​

Missing or invalid keys receive 401 with error code invalid_api_key.

{
  "error": "invalid_api_key",
  "message": "API key required. Pass X-API-Key header."
}