Stashr docs
API Keys
API keys connect Stashr to the places where your assets are used: websites, apps, CMS tools, build scripts, backend services, and automations.
Create A Key
Open Settings, create a named key, and store it immediately. Stashr only shows the full key once.
Keys look like:
stshr_live_1a2b3c4d_...
Use A Key
Use either header from a server-side environment:
Authorization: Bearer stshr_live_...
or the API key header:
X-API-Key: stshr_live_...
Scopes
Each key belongs to one workspace. A key can only access assets and folders in that workspace.
| Scope | Use it for |
|---|---|
assets:read | Reading workspace details, projects, folders, assets, usage, and upload settings. |
assets:write | Creating, uploading, moving, updating, and deleting DAM resources, and changing upload settings. |
Create separate keys for separate integrations. That makes it easier to revoke one integration without breaking the others.
Security
Treat API keys like passwords.
- Keep keys in server-side secret stores.
- Do not place keys in browser JavaScript or mobile app bundles.
- Rotate keys if they are exposed.
- Revoke keys that are no longer used.
- Use separate keys for separate sites, apps, clients, or automations.
Revoke A Key
Revoked keys stop working immediately. Existing delivery URLs and public paths remain available until the related assets are deleted.
API-key creation and revocation remain dashboard operations. The key then authenticates the complete DAM management API.