Authentication

Every request needs your API key. Keep it on the server; for public pages, use a signed URL with your public key instead.

Send your API key

Your secret key starts with sl_ and is on your dashboard. Send it in any of these ways:

X-API-Key: sl_your_key
Authorization: Bearer sl_your_key
?access_key=sl_your_key

Headers are best for server code. The query parameter is there for tools that can only set a URL; never put it in public HTML, because anyone who sees the page can use your credits.

Public key and signed URLs

Each account also has a public key that starts with pub_. On its own it can't render anything; together with an HMAC signature made with your secret key, it lets a URL go into an <img> tag safely. See Signed URLs.

Check your account

Free. Returns your remaining credits and keys:

{"email": "[email protected]", "credits": 1834, "public_key": "pub_…", "email_confirmed": true}

Sign up without a browser

Agents and scripts can create an account with an email address: {"email": "[email protected]"}. The response contains the API key, which works right away with 10 credits. The key is also emailed to that address with a confirmation link; clicking it raises the account to 100 credits a month. Agents should ask their user for the address and tell them to click the link.

curl -X POST https://shotlane.dev/v1/signup -H "Content-Type: application/json" -d '{"email":"[email protected]"}'

{"api_key": "sl_…", "public_key": "pub_…", "credits": 10, "email_confirmed": false, "next_step": "…"}

Disposable email addresses are refused, and one network can create at most 3 accounts a day. To resend the confirmation email, call POST /v1/account/confirm with the key.

OAuth for MCP clients

ChatGPT, Claude, Cursor, VS Code and other MCP clients sign in with OAuth 2.1 (PKCE, dynamic client registration); you approve the connection on a Shotlane page and never paste a key. See MCP and agents.