Authentication

All API requests must include an API key in the Authorization header as a Bearer token.

Authorization: Bearer bp_sk_live_YOUR_KEY

API Keys

API keys are created in the BinderyPress dashboard under Settings > API Keys. Each key belongs to a team and has a mode.

Key Prefixes

Prefix	Mode	Description
bp_sk_live_	Live	Production renders. Counts against your monthly quota.
bp_sk_test_	Test	Test renders. Watermarked output. Does not count against quota.

Tip

Use test keys during development. Switch to live keys when you’re ready for production.

Key Management

You can create multiple keys per team. Each key has a name for identification. Keys can be revoked at any time from the dashboard — revocation is immediate and the key will stop working on the next request.

Authentication Flow

When a request arrives with an API key:

1. The key is hashed (SHA-256) and looked up in the key store.
2. The key’s team, mode, and metadata are resolved.
3. Rate limits and quotas are checked against the team’s plan.
4. The request proceeds to the endpoint handler.

If the key is invalid or missing, the API returns 401 AUTH_REQUIRED.

Rate Limit Headers

Every response from rate-limited endpoints includes these headers:

Header	Description
X-RateLimit-Limit	Maximum requests allowed in the current window.
X-RateLimit-Remaining	Requests remaining in the current window.
X-RateLimit-Reset	Unix timestamp when the window resets.

When the rate limit is exceeded, the API returns 429 RATE_LIMITED with a Retry-After header.

Session Authentication

The BinderyPress dashboard uses session-based authentication via BetterAuth. Session tokens are used internally for dashboard operations (template editing, thumbnail generation, etc.) and are not intended for external API usage.

Note

For programmatic access, always use API keys — not session tokens.