---
title: "Authentication"
description: "Authenticate html2img API requests with the X-API-Key header. Key rotation, environment variables, security guidance."
url: "https://html2img.com/docs/authentication/"
---

# Authentication

HTML to Image uses API keys to authenticate requests. Get your key from the [dashboard](https://app.html2img.com/dashboard) and include it in the `X-API-Key` header on every request.

```bash
curl -X POST 'https://app.html2img.com/api/html' \
  -H 'X-API-Key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"html": "<h1>Hello</h1>"}'
```

Worked examples in your language live in the [integration guides](https://html2img.com/integrations/). One-line summary per language:

- **PHP and Laravel** - the official packages send the header for you. See the [PHP](https://html2img.com/integrations/php/) and [Laravel](https://html2img.com/integrations/laravel/) integrations.
- **Node.js** - pass the key in the `headers` option of `fetch`, or let the SDK do it. See the [JavaScript integration](https://html2img.com/integrations/javascript/).
- **Python** - pass `headers={'X-API-Key': ...}` to `requests.post`, or set `HTML2IMG_API_KEY` and let the client read it. See the [Python integration](https://html2img.com/integrations/python/).
- **Ruby and Rails** - set `HTML2IMG_API_KEY` and the gem reads it. See the [Ruby integration](https://html2img.com/integrations/ruby/).

## Verifying a key

`GET /api/me` returns the account behind a key - plan, credit balance and renewal date - without consuming a credit, and it works even when the account is out of credits. Use it as the connection check when a user saves their key in your integration. See the [account status docs](https://html2img.com/docs/account/).

## Storing your key

Keep the key on the server, not in client-side code. Use an environment variable so it never lands in source control.

```bash
# .env
HTML2IMG_API_KEY=htim_yourkey
```

```javascript
// Read from process.env at request time
const apiKey = process.env.HTML2IMG_API_KEY;
```

## Key rotation

Rotate keys safely with a brief overlap window. Generate a new key in the dashboard and deploy with both keys configured for an hour. Revoke the old key from the dashboard once every running instance has the new one.

## Common mistakes

- **Storing the key client-side.** Anyone viewing the page source can steal it. Always proxy through your server.
- **Logging the key in error messages or build logs.** Strip `X-API-Key` from logged requests, and avoid printing `process.env` dumps in CI.
- **Sharing one key across all services.** One key per service makes rotation safer and lets you trace usage in the dashboard.