Docs/API Keys

API Keys

API keys are scoped to a project and control access to the upload API. Each key can be restricted to specific destinations.

Key Format

API keys use the aptr_ prefix followed by a random string. Keys are only shown in full once at creation time.

aptr_{env}_{random}

Important

The plain-text key is only returned when the key is created. Store it securely — it cannot be retrieved again.

List Keys

GET/api/v1/projects/:projectId/keys

Retrieve all API keys for a project.

curl https://api.apertur.ca/api/v1/projects/proj_.../keys \
  -H "Authorization: Bearer aptr_live_xxxx"

Create a Key

POST/api/v1/projects/:projectId/keys

Generate a new API key for a project.

Field	Type	Description
label	string	Human-readable label for the key
maxImages	integer	Nombre maximal d'images autorisées par session (facultatif)
expiresAt	string \| null	Horodatage ISO 8601 après lequel la clé cesse de fonctionner, ou null pour une clé qui n'expire jamais (optionnel)

curl -X POST https://api.apertur.ca/api/v1/projects/proj_.../keys \
  -H "Authorization: Bearer aptr_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Production",
    "maxImages": 100
  }'

# Response includes plainTextKey — save it, it is only shown once!
# { "key": { "id": "key_..." }, "plainTextKey": "aptr_live_z9y8x7..." }

Assign Destinations

PUT/api/v1/keys/:keyId/destinations

Bind specific destinations to a key. Sessions created with this key will deliver images only to these destinations. Optionally enable long polling.

curl -X PUT https://api.apertur.ca/api/v1/keys/key_.../destinations \
  -H "Authorization: Bearer aptr_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "destination_ids": ["dest_abc", "dest_def"],
    "long_polling": true
  }'

Signature des requêtes

Activez ou désactivez la signature HMAC des requêtes sur une clé, ou faites pivoter son secret. Consultez Signature des requêtes pour le format complet des en-têtes et de la signature.

Activer

POST/api/v1/projects/:projectId/keys/:keyId/signing/enable

Activez la signature sur une clé et générez son signing secret.

curl -X POST https://api.aptr.ca/api/v1/projects/proj_.../keys/key_.../signing/enable \
  -H "Authorization: Bearer aptr_live_xxxx"

# Response — save the secret, it is only shown once!
# { "signingSecret": "b7e2c1f4a9..." }

Faire pivoter

POST/api/v1/projects/:projectId/keys/:keyId/signing/rotate

Remplacez le signing secret d'une clé. Le secret précédent cesse de fonctionner immédiatement.

curl -X POST https://api.aptr.ca/api/v1/projects/proj_.../keys/key_.../signing/rotate \
  -H "Authorization: Bearer aptr_live_xxxx"

# Response — the previous secret stops working immediately.
# { "signingSecret": "9f1a3d0e77..." }

Désactiver

POST/api/v1/projects/:projectId/keys/:keyId/signing/disable

Désactivez la signature pour une clé. Les requêtes n'ont plus besoin de signature.

curl -X POST https://api.aptr.ca/api/v1/projects/proj_.../keys/key_.../signing/disable \
  -H "Authorization: Bearer aptr_live_xxxx"

# { "ok": true }

← Destinations Suivant : Webhooks →