Authentication

The v2 API accepts NiftyImages API keys only through the standard Authorization header.

Bearer keys

Authorization: Bearer $NIFTYIMAGES_API_KEY

Do not send API keys in query strings, custom headers, or Basic auth. Bearer auth keeps the API compatible with generated SDKs, HTTP clients, and agent tools.

Most API keys are account-scoped and can access all resources available to the account. Store API Keys start with store- and are limited to one store. They can be used for store record workflows, but cannot create stores, delete stores, change store schemas, or access other stores.

Test a key

The safest first call is GET /v2/whoami. It returns the public identity for the API key without changing anything.

curl https://dev.niftyimages.com/v2/whoami \
  -H "Authorization: Bearer $NIFTYIMAGES_API_KEY"

For store workflows, GET /v2/stores/access reports whether the key is account-scoped or tied to a single store.

curl https://dev.niftyimages.com/v2/stores/access \
  -H "Authorization: Bearer $NIFTYIMAGES_API_KEY"