Authentication

Bearer token

Every request will include an Authorization: Bearer <key> header.

curl -X POST https://gptimage2api.org/api/ai/image/generate \
-H "Authorization: Bearer sk_live_••••••••••••••••" \
-H "Content-Type: application/json" \
-d '{"prompt": "...", "model": "gpt-image-2"}'

• Only Bearer Token authentication is supported.
• Keys are scoped per account and can be rotated or revoked from the dashboard.
• Missing or invalid tokens return 401 Unauthorized.
• A single key authenticates calls to every endpoint listed in the API reference.

Get your API key

You can create and manage keys from the API Keys page:

https://gptimage2api.org/api-keys

Recommended flow:

1. Sign in to your account.
2. Open the left navigation and go to API Keys.
3. Click Create Key.
4. Enter a recognizable name for the key.
5. Optionally set an IP allowlist or expiration time.
6. Create the key and copy it immediately for your backend, script, or CI secret store.

The page route is /api-keys, and the UI entry label is API Keys.

Use the key

• Send it in the Authorization header as Bearer <your-key>.
• Keep it server-side only. Do not expose it in client-side JavaScript.
• If a key is leaked, revoke it from API Keys and create a new one.

What belongs to whom

Each task is scoped to the caller. GET /api/ai/tasks/{id} returns 404 Task not found if the requested task belongs to a different user, even if the ID exists.

Questions

Ping support via the address in our Terms or the in-app chat.