Skip to main content
An integration key lets code outside Pixio act on your account. Create one per place you use it, so you can disable that one without breaking the others.

​
Creating a key

1

Open Integrations

Click Integrations in the sidebar.
2

Name it

Name the key after where it will be used — Production, Local dev, Zapier. The name is how you’ll recognize it later.
3

Choose its reach

Select which areas the key may touch (below). Grant only what the integration needs.
4

Copy it

Copy the key immediately and store it somewhere safe. Treat it like a password.

​
What a key can reach

Access is grouped, so you can hand out narrow keys:
A key that only needs to generate images doesn’t need project or training access. Narrow scopes limit the damage if a key leaks.

​
Using a key

Send it as a Bearer token:
Everything a key does is billed to the same credit balance and constrained by the same plan as your account in the app.

​
Disabling and re-enabling

Keys are disabled, not deleted — so the record of what existed stays intact.
  • Disable key stops it working immediately. Any integration using it starts failing on the next request.
  • Disabled keys are hidden by default; toggle Show disabled to see them.
  • A disabled key can be enabled again if you disabled it by mistake.
If a key leaks, disable it first and ask questions after. A leaked key can spend every credit on your account.

​
Good practice

  • One key per environment. Never share a key between production and local development.
  • Server-side only. A key in client-side JavaScript or a mobile app binary is a public key.
  • Environment variables, never source control. Add your .env to .gitignore.
  • Rotate on staff change. Create the replacement, switch over, then disable the old one — in that order, so nothing breaks mid-cutover.
  • Name honestly. test2 tells you nothing in six months.

​
Troubleshooting

The key is wrong, disabled, or missing from the header. Check the header is exactly Authorization: Bearer <key>, then confirm the key is still Active in Integrations.
The key is valid but lacks the scope for that operation. Check its scopes against the table above.
The account is out of credits — the same wall you’d hit in the app. Top up on Billing.
Access is per plan, not per surface. If your plan can’t run it in the UI, a key can’t either.
Key storage isn’t configured on that environment. This affects self-hosted or preview deployments, not the hosted app.