API keys

API keys authenticate requests to the Format API. Each key belongs to an organization, and renders made with it count toward that organization's usage.

Key ownership

Choose an ownership type based on how the key will be used.

Any member can create personal keys. Only admins and owners can create organization keys.

In your personal organization, keys are created without an ownership choice.

Create a key

1. Open the Format dashboard, select your organization, and go to API Keys.
2. Select Create API key.
3. Enter a name that describes the key's purpose, such as Production backend. Select an ownership type if the option is available.
4. Select Create, then copy the key before closing the dialog.

The full key is shown only once. Store it in a secret manager or your application's environment. If you lose it, create a replacement.

Keep API keys out of source control, logs, and browser code. Use a separate key for each application or environment so you can replace one without changing the others.

Authentication

Set FORMAT_API_KEY in your application's environment:

FORMAT_API_KEY=your_api_key_here

The Node.js client and Studio use this variable to authenticate render requests. For direct HTTP requests, send the key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

To render for another organization, use a key created in that organization. Switching organizations in the dashboard or Studio doesn't change the key your application uses.

Manage keys

The API Keys page lists the keys you can manage, with their names, key prefixes, and creation and last-used times. Members can manage their own personal keys. Admins and owners can manage all keys in the organization.

Open a key's actions menu and select Edit name to rename it. Renaming changes only the label; applications can continue using the same key.

To revoke a key, select Revoke key, enter its name, and confirm. Revocation is permanent and can take up to 20 seconds to take effect at the render API. It doesn't delete existing render history or usage totals.

Rotate a key

Replace a key without interrupting your application:

1. Create a new key in the same organization.
2. Update each application or environment that uses the old key.
3. Confirm that renders succeed with the new key.
4. Revoke the old key.

If a key has been exposed, revoke it as soon as possible and configure a replacement.