API authentication

All Streampixel API endpoints require an API key for authentication. Where the key goes depends on the request method:

Method	Where the key goes	Endpoints
`POST`	`apiKey` field in the JSON body	Upload File, Distribute File
`GET`	`x-api-key` request header	List Projects, Project User Stats

Never put the key in a URL. Query-string keys (?apikey=) are rejected with 400 API_KEY_IN_QUERY — URLs end up in access logs, browser history, and Referer headers. If a key has ever been sent in a URL, treat it as compromised and rotate it from the dashboard.

Generate an API key

Go to dashboard.streampixel.io and sign in.

Open your account menu

Click your account name in the top-right corner.

Request the key

Click the Request API Key button.

Check your email

The key is sent to your registered email address.

Your API key is shown only once. Copy and store it securely — you won’t be able to view it again.

Requesting a new API key automatically invalidates the previous one. Any integration still using the old key will stop working immediately.

Use the API key

For POST endpoints, include apiKey in the JSON body. For GET endpoints, send the x-api-key header (see the List Projects page for GET examples):

curl -X POST https://platform.streampixel.io/api/v1/projects/upload-file \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "your-api-key-here",
    "userId": "your-user-id",
    "projectId": "your-project-id",
    "fileUrl": "https://storage.example.com/build.zip"
  }'

const response = await fetch(
  'https://platform.streampixel.io/api/v1/projects/upload-file',
  {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      apiKey: 'your-api-key-here',
      userId: 'your-user-id',
      projectId: 'your-project-id',
      fileUrl: 'https://storage.example.com/build.zip',
    }),
  }
);

import requests

response = requests.post(
    'https://platform.streampixel.io/api/v1/projects/upload-file',
    json={
        'apiKey': 'your-api-key-here',
        'userId': 'your-user-id',
        'projectId': 'your-project-id',
        'fileUrl': 'https://storage.example.com/build.zip',
    }
)

Authentication errors

Status	Message	Cause
`400`	`API_KEY_IN_QUERY`	The key was sent as a URL query parameter. Move it to the right place and rotate the key.
`401`	`Unauthorized: Invalid API Key`	Key is wrong or has been invalidated (POST endpoints)
`401`	`Authentication required`	Missing/invalid `x-api-key` header (GET endpoints)
`401`	`Invalid User`	`userId` doesn’t match any account (POST endpoints)
`403`	`Access denied`	The target project/`userId` doesn’t belong to the key’s account

Receiving a 401? Generate a new API key from the dashboard and update your integration.

Security best practices

Never expose your API key in frontend code, public repos, or client-side bundles.
Store it in environment variables or a secrets manager.
Rotate the key periodically by requesting a new one from the dashboard.
The API only accepts HTTPS — there is no HTTP fallback.

Next steps

Find your IDs

Locate your userId and projectId in the dashboard.

Upload a build

Submit your first build with the API key you just generated.

Getting started

Endpoints

Webhooks

Generate an API key

Use the API key

Authentication errors

Security best practices

Next steps

Find your IDs

Upload a build

​Generate an API key

​Use the API key

​Authentication errors

​Security best practices

​Next steps

Find your IDs

Upload a build

Generate an API key

Use the API key

Authentication errors

Security best practices

Next steps