SignalShelf · Developer documentation

Authenticate requests securely

Use a SignalShelf API key for server integrations and a session cookie for the first-party dashboard.

API key header

Send x-api-key on protected API routes. The header takes precedence over a session cookie: an invalid header does not fall back to a valid browser session. Do not place keys in query strings or paste them into URLs.

EXAMPLE

GET /api/me
x-api-key: ss_live_YOUR_PRIVATE_KEY

Full account privileges

Keys are not scoped or read-only in this beta. A valid key can access protected account routes including profile lookups, saved creators, usage, and creation or revocation of other keys. Multiple keys share the same account balance and data. Only give a key to trusted server integrations; use separate accounts where isolation is required.

Dashboard sessions

The dashboard uses the HttpOnly ss_session cookie. Sessions expire after seven days. Production cookies use Secure, and SameSite is strict. POST /api/auth/register accepts name, email, and password; POST /api/auth/login accepts email and password. Passwords must contain 10–128 characters at registration. Logout clears the current browser session.

Origins and browser integrations

Cross-origin browser mutations are rejected when the Origin header differs from the configured application origin. No public browser CORS integration is provided. Keep third-party integrations server-side; never embed a full account key in public JavaScript.

Check your credentials

GET /api/me returns the authenticated user id, name, email, and current credit balance. A missing or invalid credential returns HTTP 401. The following shape is illustrative.

EXAMPLE

{
  "user": {
    "id": "example-user-id",
    "name": "Example User",
    "email": "you@example.com",
    "credits": 1000
  }
}

Recovery and permission boundaries

Email verification, password-reset delivery, organization roles, and scoped service tokens are not included in the beta. If a key is exposed, revoke it and create another. Keep account authentication separate from social-account access: a SignalShelf key does not sign in to Instagram or expose private content.

Explore the API in your workspace. Sample results and accepted cache hits cost zero credits. Open the playground →