Offer controlled API access to customer websites from one dashboard

Lifecycle Actions

• Create key
• List keys
• Rotate key
• Revoke key
• Assign scopes (`read`, `write`, `webhook`)
• Set expiration and status

Storage + Display Rules

• Store only hashed keys in database
• Show plaintext key once at creation time
• Never expose full key again in UI or logs
• Audit all lifecycle actions with actor and timestamp
• Support emergency revoke with immediate effect

Access Validation

• Validate key hash and tenant ownership
• Reject expired, revoked, or suspended keys
• Require scope match per endpoint
• Apply optional domain/IP allowlist checks

Rate Limiting

• Per-key request per minute limits
• Per-tenant request controls
• Throttle and reject behavior on limit breach
• Usage logs for billing and review workflows

Error Responses

• `401 invalid_api_key`
• `403 insufficient_scope`
• `403 key_revoked`
• `429 rate_limited`
• `403 origin_not_allowed` / `403 ip_not_allowed`

Base Setup

1. Buy or upgrade to an API-enabled plan.
2. Create a key from Dashboard > Developer API Keys.
3. Set scopes, environment, and optional expiry/allowlists.
4. Save the key in secure server environment variables.
5. Call `/api/v1/content/generate` and `/api/v1/account/usage` from backend services.

Required Headers

• `Authorization: Bearer YOUR_API_KEY`
• `Content-Type: application/json`
• `X-Request-Id: unique-id` (recommended for tracing)
• `Origin` (required if origin allowlist is configured)

cURL Request

curl -X POST "https://your-domain.com/api/v1/content/generate" \
  -H "Authorization: Bearer aw_live_xxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "source_url": "https://example.com/article",
    "language": "Hindi",
    "mode": "translate",
    "publish": true,
    "site_id": 12,
    "status": "draft"
  }'

JavaScript Fetch

const response = await fetch("https://your-domain.com/api/v1/content/generate", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.AUTOPUBLIQ_API_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    source_url: "https://example.com/article",
    language: "English",
    mode: "native",
    publish: false
  })
});

const data = await response.json();
if (!response.ok) throw new Error(data.error || "API request failed");

Node.js with Axios

const axios = require("axios");

async function generateArticle(payload) {
  const client = axios.create({
    baseURL: "https://your-domain.com/api/v1",
    timeout: 15000,
    headers: {
      Authorization: `Bearer ${process.env.AUTOPUBLIQ_API_KEY}`,
      "Content-Type": "application/json"
    }
  });

  const { data } = await client.post("/content/generate", payload);
  return data;
}

Webhook Signature Verify (Node)

const crypto = require("crypto");

function verifyWebhookSignature(rawBody, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}