Skip to main content

​
API Key Authentication

All Snipp API endpoints require authentication. Include your API key in the api-key header with every request.

​
Where to Find Your API Key

API keys belong to apps. Each app is a named key, such as one for ShareX and one for a script, so you can revoke one without breaking the others. You can create up to 10 apps, and every app uploads to your own gallery and counts against your own quota.
  1. Sign in to your account.
  2. Go to Settings and open Apps.
  3. Create an app, or open an existing one, and copy its API key.

​
Examples

​
API Key Permissions

Every key can upload. Reaching the uploads already in your gallery is a separate permission, set per app and off by default: Without gallery access, GET /posts, PATCH /posts/{code}, DELETE /posts/{code}, POST /posts/{code}/files and DELETE /posts/{code}/files/{name} return 403 with type forbidden. POST /upload is unaffected. You can check whether gallery access is enabled by calling GET /users/@me and reviewing the key_has_uploads_access field, which reports the key used for that request. The field name is historical and reports gallery access.

​
Team Access Keys

Teams (an Ultra feature) each have a dedicated access key. A team key is passed in the same api-key header as a personal API key, and uploads made with it go to the team’s shared gallery instead of a personal account. It is only accepted on POST /upload, PATCH /posts/{code}, DELETE /posts/{code}, POST /posts/{code}/files, DELETE /posts/{code}/files/{name} and POST /convert. Every other endpoint, including GET /users/@me, GET /posts and GET /posts/{code}, returns 401 for a team key. Read team posts with a member’s personal key.
Key differences when uploading with a team key:
  • Files are stored in the team gallery, not a personal gallery.
  • Uploads count against the team’s weekly quota, never a member’s personal quota.
  • Team-key uploads are always created private, regardless of the post-privacy header, and their privacy cannot be changed afterward. Team posts are never unlisted or public.
  • Only the team owner can regenerate or delete the key, from the team’s settings page.
  • If the team’s subscription lapses, POST /upload, POST /posts/{code}/files and POST /convert with the key return 403 with type forbidden. Editing and deleting existing team posts keep working.
  • If the team owner’s account is suspended, the key is refused on every endpoint with the same 403 a suspended personal key gets, with type suspended.
The same key also works on the Relay API, passed in its relay-key header, on the same endpoints. Anyone who holds a team key can upload with it, so treat it like any other credential and share it only with trusted team members.

​
Security Best Practices

  • Never expose your API key in client-side code, public repositories, or shared documents.
  • Use environment variables in production (for example, process.env.SNIPP_API_KEY).
  • Use one app per integration so a leaked key can be revoked without touching anything else.
  • Rotate your key immediately if you suspect it has been compromised. You can regenerate it, or delete the app, under Apps in settings.
  • Limit upload access if your integration only needs read access.

​
Error Responses

Every error returns an error object with type and message. See Errors.