SmallPict LogoSmallPict
Back to Home

API Key Management

Understand API key scoping, limits, and how to manage your credentials securely.

SmallPict secures all automated interactions through API keys. These keys act as passwords for your applications to communicate with our services.

Key Scopes: WordPress vs API/SDK

To ensure security and proper billing attribution, every API key generated in SmallPict is explicitly scoped to a single product line.

WordPress Plugin Keys

Keys scoped to "WordPress" can only be used to authenticate the SmallPict WordPress plugin.

  • They are authorized to use the endpoints required by the plugin to upload, compress, and sync images.
  • They cannot be used to make direct REST API calls or initialize a SmallPict SDK in a custom Node.js/Python application.

API/SDK Keys

Keys scoped to "API/SDK" are designed for custom backend development.

  • They grant access to the api.tuxnoob.com/v1/images/optimize endpoints and other developer-centric features.
  • They cannot be used to authenticate the WordPress plugin.

[!WARNING] Attempting to use a WordPress key for an API/SDK workload (or vice versa) will result in a 403 Forbidden error. Ensure you generate the correct key type for your use case.

WordPress Key Limits

To maintain a clean dashboard and prevent credential sprawl, SmallPict enforces a limit on the number of active WordPress-scoped API keys per account.

  • Maximum Limit: 2 active WordPress API keys per account.
  • Why 2 keys? Because paid WordPress plans include unlimited site registrations sharing a single quota pool, you do not need a separate key for each site. You can use the same key across multiple WordPress installations. The limit of 2 allows you to keep one for yourself and share the second one securely with a developer or agency managing your other sites.

Rotating Keys

If you suspect an API key has been compromised, or if a developer leaves your team, you should rotate the key immediately.

  1. Navigate to API Keys in your Dashboard.
  2. Generate a new key with the appropriate scope.
  3. Update your WordPress plugin(s) or backend applications with the new key.
  4. Delete the old key from the dashboard. Once deleted, any application attempting to use the old key will instantly fail to authenticate.

Note: SmallPict never stores or displays your API key in plain text after it is generated. If you lose your key, you must generate a new one.