Reference · Authentication

Photta API authentication one key, one header

In one sentence

Send your key as `Authorization: Bearer photta_live_xxx` on every Photta API call. Keys are created in the dashboard, carry no per-endpoint scope, and share one credit balance.

Get an API key Read the docs

Authentication: Bearer key
Limits: 600 requests/min
Processing: async, polling

Every figure on this page comes from the Photta API docs · checked 2026-09-10

What the API expects

Authentication at a glance

Header: Authorization: Bearer photta_live_xxx
Key prefix: photta_live_
Base URL: https://api.photta.app/api/v1
Where keys are created: https://ai.photta.app
Scope: One key reaches every endpoint and one credit balance

Check a key in one call

The account endpoint is free, so it is the safe way to confirm a key works.

curl https://api.photta.app/api/v1/account \
  -H "Authorization: Bearer $PHOTTA_API_KEY"

const res = await fetch("https://api.photta.app/api/v1/account", {
  headers: { Authorization: `Bearer ${process.env.PHOTTA_API_KEY}` },
});
const { data } = await res.json();

import os, requests

res = requests.get(
    "https://api.photta.app/api/v1/account",
    headers={"Authorization": f"Bearer {os.environ['PHOTTA_API_KEY']}"},
)
data = res.json()["data"]

Handling keys

Rotate on suspicion
The documentation is explicit: rotate a key immediately if you suspect it has been compromised. Generate the replacement first, deploy it, then retire the old one.
Keep it on the server
A key that reaches a browser reaches everyone who opens the page. Call the API from your backend and pass results to the client.
401 means the key, not the request
A missing, invalid or expired key returns `authentication_error`. Check the header for typos and stray whitespace before looking anywhere else.
One balance behind every key
Keys are not scoped per capability. Several keys for several environments still spend the same credit balance, which GET `/api/v1/account` reports.

Questions about authentication

How do I authenticate a request?

Send the key in the Authorization header as a bearer token on every call. There is no separate login or token-exchange step.

Where do I create a key?

In your Photta dashboard. The same place issues replacements, which is what the documentation points you to after a 401.

Can I call the API from the browser?

Not with your key. Anything shipped to a browser is readable by its visitors, so put the call behind your own server and forward the result.

What if a key leaks?

Rotate it immediately — generate a new key, deploy it, then delete the old one. Credits already spent cannot be recovered, so rotate first and investigate afterwards.

Endpoints and references

Every figure on this page comes from the Photta API docs · checked 2026-09-10

Try the API in five minutes

Generate a Photta API key, paste the cURL snippet above, and you'll have your first on-model image before the coffee finishes brewing.

Create an account and get an API key API

Bearer key
600 requests/min
async, polling