Static API keys

Use a static API key to authenticate your integration. Generate the key in the Photo Collect web interface and assign it to a system account with the roles and site access your integration needs. System accounts authenticate API requests but cannot log in to the web interface.

API keys are exactly 36 characters and contain only ASCII letters, digits, or hyphens.

Send the key with either supported header format:

Authorization: Custom <API_KEY>

X-Api-Key: <API_KEY>

The interactive console uses the Authorization form. The key is stored only in a server-side session and is masked in the user interface.

Permissions

Your API key inherits the assigned account's roles and site permissions. Each endpoint checks the permissions needed for its operation. Account restrictions still apply; a key does not bypass a blocked or expired account.

Verify your credentials

Call GET /token with your API key or access token to resolve the authenticated user, roles, accessible sites, and locale defaults. No app secret is required. Manage account roles and site assignments in the Photo Collect web interface.

App-only token creation

POST /token is reserved for internal use by the Photo Collect app. It requires a valid app secret in addition to a username and password sent using HTTP Basic authentication. System account credentials alone do not grant access to this endpoint.

Use a static API key directly for your integration's API requests; you do not need to create a user token first.

Errors

Invalid or missing credentials return HTTP 401 with an error body such as:

{
  "error": "Invalid token provided",
  "errorcode": "ACCESS_DENIED"
}

Keep keys outside source control, rotate them when exposure is suspected, and never log the full authorization header.