Authentication

Access

The API is available to paying customers. You can mint and use keys once your account has an active paid subscription or at least one completed credit-pack purchase (members of a paid team qualify too). Free accounts can browse the dashboard, but calls to /v1 return 403 until a payment is on file.

Issuing a key

1. Open your account settings → API keys.
2. Click Create key.
3. Copy the key immediately — it is shown once. PicoBerry stores only a hash and cannot show it again.

Using a key

Send the key in either header on every request:

GET /v1/assets/019f3a39-0db2-743b-959a-d3949e24d4e7 HTTP/1.1
Host: api.picoberry.ai
Authorization: Bearer pb_live_xxxxxxxxxxxx

Or:

x-api-key: pb_live_xxxxxxxxxxxx

A key inherits your account's credit balance and permissions, so treat it like a password.

Rotating a key

If a key is compromised:

1. Create a new key first — don't break running integrations.
2. Update your services to use the new key.
3. Revoke the old key from the dashboard.

Security guidelines

• Treat API keys like passwords. Do not commit them to source control or CI logs.
• Use a secret manager (.env, Cloud Secret Manager, AWS Secrets Manager, Vercel env vars).
• Server-side only — never ship a key to a browser or mobile client.
• If a key is exposed, revoke it immediately — a leaked pb_live_ key can spend your whole balance.