Authentication
The capture API authenticates with an API key sent as a bearer token. That path is not open during the beta: keys you create in Dashboard → API Keys are stored and shown to you once, but nothing reads them yet, so a request carrying one is not accepted.
Direct API access is not open during the beta. API keys created in the dashboard authenticate nothing — no request anywhere is accepted with one — and screenshots are captured from the dashboard instead.
These pages describe the capture service the dashboard talks to. Read every request below as the shape of the interface that will open, not as a call you can make today.
Authorization: Bearer papi_live_4f8a…Key format
Keys start with a visible prefix (papi_live_) followed by a 32-character secret. The full key is shown once at creation — store it in your secret manager immediately. The dashboard only ever displays the prefix and the last four characters afterwards, because only a hash of the key is kept.
Unauthenticated requests
When direct access opens, a missing, malformed, or revoked key will return 401 with error code MISSING_API_KEY or INVALID_API_KEY. See Errors.