Authentication

HTML to Image uses API keys to authenticate requests. Get your key from the dashboard and include it in the X-API-Key header on every request.

curl -X POST 'https://app.html2img.com/api/html' \
  -H 'X-API-Key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"html": "<h1>Hello</h1>"}'

Worked examples in your language live in the integration guides. One-line summary per language:

PHP and Laravel - the official packages send the header for you. See the PHP and Laravel integrations.
Node.js - pass the key in the headers option of fetch, or let the SDK do it. See the JavaScript integration.
Python - pass headers={'X-API-Key': ...} to requests.post, or set HTML2IMG_API_KEY and let the client read it. See the Python integration.
Ruby and Rails - set HTML2IMG_API_KEY and the gem reads it. See the Ruby integration.

Verifying a key

GET /api/me returns the account behind a key - plan, credit balance and renewal date - without consuming a credit, and it works even when the account is out of credits. Use it as the connection check when a user saves their key in your integration. See the account status docs.

Storing your key

Keep the key on the server, not in client-side code. Use an environment variable so it never lands in source control.

# .env
HTML2IMG_API_KEY=htim_yourkey

// Read from process.env at request time
const apiKey = process.env.HTML2IMG_API_KEY;

Key rotation

Rotate keys safely with a brief overlap window. Generate a new key in the dashboard and deploy with both keys configured for an hour. Revoke the old key from the dashboard once every running instance has the new one.

Common mistakes

Storing the key client-side. Anyone viewing the page source can steal it. Always proxy through your server.
Logging the key in error messages or build logs. Strip X-API-Key from logged requests, and avoid printing process.env dumps in CI.
Sharing one key across all services. One key per service makes rotation safer and lets you trace usage in the dashboard.