Docs/API Keys

API Keys

API keys are scoped to a project and control access to the upload API. Each key can be restricted to specific destinations.

Key Format

API keys use the aptr_ prefix followed by a random string. Keys are only shown in full once at creation time.

aptr_{env}_{random}

Important

The plain-text key is only returned when the key is created. Store it securely — it cannot be retrieved again.

List Keys

GET/api/v1/projects/:projectId/keys

Retrieve all API keys for a project.

curl https://api.apertur.ca/api/v1/projects/proj_.../keys \
  -H "Authorization: Bearer aptr_live_xxxx"

Create a Key

POST/api/v1/projects/:projectId/keys

Generate a new API key for a project.

Field	Type	Description
label	string	Human-readable label for the key
maxImages	integer	Número máximo de imágenes permitidas por sesión (opcional)
expiresAt	string \| null	Marca de tiempo ISO 8601 tras la cual la clave deja de funcionar, o null para una clave que nunca vence (opcional)

curl -X POST https://api.apertur.ca/api/v1/projects/proj_.../keys \
  -H "Authorization: Bearer aptr_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Production",
    "maxImages": 100
  }'

# Response includes plainTextKey — save it, it is only shown once!
# { "key": { "id": "key_..." }, "plainTextKey": "aptr_live_z9y8x7..." }

Assign Destinations

PUT/api/v1/keys/:keyId/destinations

Bind specific destinations to a key. Sessions created with this key will deliver images only to these destinations. Optionally enable long polling.

curl -X PUT https://api.apertur.ca/api/v1/keys/key_.../destinations \
  -H "Authorization: Bearer aptr_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "destination_ids": ["dest_abc", "dest_def"],
    "long_polling": true
  }'

Firma de solicitudes

Active o desactive la firma HMAC de solicitudes en una clave, o rote su secreto. Consulte Firma de solicitudes para conocer el formato completo de encabezados y firma.

Habilitar

POST/api/v1/projects/:projectId/keys/:keyId/signing/enable

Habilite la firma en una clave y genere su signing secret.

curl -X POST https://api.aptr.ca/api/v1/projects/proj_.../keys/key_.../signing/enable \
  -H "Authorization: Bearer aptr_live_xxxx"

# Response — save the secret, it is only shown once!
# { "signingSecret": "b7e2c1f4a9..." }

Rotar

POST/api/v1/projects/:projectId/keys/:keyId/signing/rotate

Reemplace el signing secret de una clave. El secreto anterior deja de funcionar de inmediato.

curl -X POST https://api.aptr.ca/api/v1/projects/proj_.../keys/key_.../signing/rotate \
  -H "Authorization: Bearer aptr_live_xxxx"

# Response — the previous secret stops working immediately.
# { "signingSecret": "9f1a3d0e77..." }

Deshabilitar

POST/api/v1/projects/:projectId/keys/:keyId/signing/disable

Desactive la firma para una clave. Las solicitudes ya no necesitarán una firma.

curl -X POST https://api.aptr.ca/api/v1/projects/proj_.../keys/key_.../signing/disable \
  -H "Authorization: Bearer aptr_live_xxxx"

# { "ok": true }

← Destinations Siguiente: Webhooks →