Skip to main content
Every REST endpoint authenticates with an API key sent in the x-api-key header. The key identifies your account; the endpoint then applies the same ownership and team-role checks the dashboard does, so a key can never reach another account’s projects.
Two endpoints are the exception. Upload File and Distribute File predate the header and require the key as apiKey in the JSON body, together with userId, exactly as their examples show; the header alone returns 400 Missing required fields. Both are POST requests. A GET with a JSON body is rejected at the edge with an HTML 400 Bad Request page before it reaches the API.
Never put the key in a URL. Query-string keys (?apikey=) are rejected with 400 API_KEY_IN_QUERY, because URLs end up in access logs, browser history and Referer headers. If a key has ever been sent in a URL, treat it as compromised and rotate it.

​
Scopes

A key is issued with one or more scopes. They are fixed when the key is created and cannot be widened afterwards; a key on a route outside its scope gets 403 API_KEY_SCOPE naming the scope it lacks. Keys issued before scopes existed carry upload and read, exactly what they could do before. Nothing already deployed gains the ability to switch a project off.
Give a CI pipeline upload and read. Give control only to the automation that needs it, on its own account or team member where possible, because a leaked control key can take a project offline until it is rotated.

​
Generate an API key

1

Log in to the dashboard

Go to dashboard.streampixel.io and sign in.
2

Open your account menu

Click your account name in the top-right corner.
3

Choose scopes

Under Settings → API Keys, tick the scopes the key should have. Upload and Read are on by default; tick Control only for automation that must switch projects or change settings.
4

Request the key

Click Request API Key. The key is emailed to you and shown once, with its scopes.
Your API key is shown only once, and requesting a new key invalidates the previous one immediately.

​
Issuing a key programmatically

The dashboard is the usual way. The same endpoint is available to a dashboard login (never to a key, so a key cannot widen itself):
200 OK

​
Team members

A key inherits the role of the team member it was issued to. Owners, admins and editors can use every scope on the projects they can see. An uploader’s key can upload, read, and, when issued with the control scope, set the live build; it cannot switch a project on or off, end sessions or change settings. A viewer’s key can only read; a finance member’s key cannot use the API. Removing a member from the team invalidates what their key can reach at once.

​
Authentication errors

403 API_KEY_SCOPE

​
Security best practices

  • Never expose your API key in frontend code, public repositories or client-side bundles.
  • Store it in environment variables or a secrets manager.
  • Issue the narrowest scopes the integration needs.
  • Rotate the key periodically, and immediately on any suspected exposure.
  • The API only accepts HTTPS; there is no HTTP fallback.

​
Next steps

Find your IDs

Locate your userId and projectId in the dashboard.

Rate limits & errors

Limits, status codes and the error format.