Creating an API Key

1. Sign up at altextapi.com/signup — you'll get your first key immediately
2. Go to the Dashboard to manage keys
3. Click New Key, give it a label (e.g., "Production", "Staging")
4. Copy the key immediately — it won't be shown again

Key Format

All API keys follow this format:

alt_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The alt_ prefix identifies AltText API keys. The remaining 64 hex characters are cryptographically random.

Managing Keys

| Action | How | |--------|-----| | Create key | Dashboard → New Key → enter label → Generate | | Revoke key | Dashboard → click key's Revoke button | | Rotate key | Dashboard → click key's Rotate button (revokes old, creates new) | | List keys | Dashboard → enter your API key → all keys shown | | Check usage | Dashboard → shows credits used/remaining per plan |

API Key Endpoints

| Method | Path | Auth | Description | |--------|------|------|-------------| | GET | /api/keys | X-API-Key | List all active keys for your account | | POST | /api/keys | X-API-Key | Create a new key (optional: label, expires_in_days) | | POST | /api/keys/revoke | X-API-Key | Revoke a key by key_prefix | | POST | /api/keys/rotate | X-API-Key | Rotate a key (revoke old + create new) |

Create a Key via API

curl -X POST https://api.altextapi.com/api/keys \
  -H "Content-Type: application/json" \
  -H "X-API-Key: alt_YOUR_KEY" \
  -d '{"label": "Production", "expires_in_days": 90}'

Response (key shown only once):

{
  "api_key": "alt_xxxxxxxx...",
  "prefix": "alt_xxxxxxxx",
  "label": "Production",
  "expires": 1749600000,
  "message": "Save this API key now — it will not be shown again."
}

List Your Keys

curl https://api.altextapi.com/api/keys \
  -H "X-API-Key: alt_YOUR_KEY"

Revoke a Key

curl -X POST https://api.altextapi.com/api/keys/revoke \
  -H "Content-Type: application/json" \
  -H "X-API-Key: alt_YOUR_KEY" \
  -d '{"key_prefix": "alt_xxxxxxxx"}'

Rotate a Key

curl -X POST https://api.altextapi.com/api/keys/rotate \
  -H "Content-Type: application/json" \
  -H "X-API-Key: alt_YOUR_KEY" \
  -d '{"key_prefix": "alt_xxxxxxxx"}'

Security Best Practices

• Use environment variables: Store keys in .env files, never in source code
• Rotate regularly: Generate a new key every 90 days via Dashboard → Rotate
• Revoke compromised keys: If a key leaks, revoke it immediately
• Label your keys: Use labels like "Production", "Staging", "WordPress Site X"
• Set expiry: New keys can have an optional expiration date

Key Storage

AltText API stores only a cryptographic hash of your key (HMAC-SHA256 with per-key salt). We cannot recover or re-display your key after creation. If you lose a key, rotate it from the dashboard.

Validating a Key

curl -X POST https://api.altextapi.com/api/validate-key \
  -H "Content-Type: application/json" \
  -d '{"api_key": "alt_YOUR_KEY"}'

Successful response:

{
  "valid": true,
  "plan": "free",
  "credits_total": 50,
  "credits_used": 12,
  "credits_remaining": 38
}