Authentication

The HeadshotPro API uses Bearer token authentication. All requests must include your API key in the Authorization header.

Getting Your API Key

1. Log in to HeadshotPro as a Team Owner or Admin
2. Navigate to Admin Dashboard > API
3. Click Generate API Key
4. Copy and securely store your key

Important: API keys are shown only once. Store them securely and never commit them to source control.

Making Authenticated Requests

Include your API key in the Authorization header:

curl -X GET "https://server.headshotpro.com/api/v2/organization" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Node.js Example

const response = await fetch('https://server.headshotpro.com/api/v2/organization', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${process.env.HEADSHOTPRO_API_KEY}`,
    'Content-Type': 'application/json'
  }
});

const data = await response.json();

Python Example

import requests

headers = {
    'Authorization': f'Bearer {os.environ["HEADSHOTPRO_API_KEY"]}',
    'Content-Type': 'application/json'
}

response = requests.get(
    'https://server.headshotpro.com/api/v2/organization',
    headers=headers
)

API Key Scopes

API keys are scoped to your organization. All actions performed with the key are associated with your organization and subject to your plan's limits.

Security Best Practices

1. Never expose keys in client-side code - API keys should only be used server-side
2. Use environment variables - Store keys in environment variables, not in code
3. Rotate keys periodically - Generate new keys and invalidate old ones
4. Monitor usage - Review API logs for unexpected activity
5. Limit access - Only share keys with team members who need them

Authentication Errors

Example Error Response

{
  "success": false,
  "error": "Invalid API key",
  "code": "UNAUTHORIZED"
}

Regenerating Your API Key

If your API key is compromised:

1. Go to Settings > API
2. Click Delete API Key
3. Click Generate API Key to create a new one
4. Update all applications using the old key

The old key is immediately invalidated when deleted.