API Authentication

How to authenticate API requests and manage access safely.

WriterzRoom API requests use Bearer token authentication.

API keys are generated from the product settings area on supported plans and supplied in the Authorization header for each request.

Authorization: Bearer YOUR_API_KEY

Authentication Overview

Authenticate

Send a Bearer token with every protected request.

Protect

Store keys in secure server-side environments.

Rotate

Replace keys after exposure or access changes.

Audit

Track usage through generation and content records.

When Authentication Applies

API authentication is required for integrations that create content, check generation status, retrieve saved content, or access account-level configuration programmatically.

Applications

Embed WriterzRoom generation inside products, portals, dashboards, and internal tools.

Automation

Connect structured content workflows to editorial systems, campaign operations, and backend jobs.

Enterprise Operations

Support governed content workflows where access control, usage tracking, and auditability matter.

Request Header

Every authenticated request should include these headers.

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Example Request

curl -X POST https://api.writerzroom.com/v1/generate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "blog_article_generator",
    "style_profile_id": "general_blog",
    "generation_mode": "standard",
    "vertical_id": "saas_tech",
    "user_input": {
      "topic": "The future of AI in content marketing",
      "target_audience": "Marketing directors at B2B SaaS companies",
      "objective": "Educate on practical AI adoption strategies"
    }
  }'

Authentication Flow

1. Generate an API key

   Go to Settings → API Access and create a new API key for your integration.

2. Copy the key once

   Copy the key immediately. For security, it may not be shown again after creation.

3. Store it securely

   Save the key in an environment variable, deployment secret, or managed secrets service.

4. Send the Bearer token

   Add the key to every API request using the Authorization header.

Key Management Guidance

Practice	Guidance
Storage	Use environment variables, deployment secrets, or managed secret stores
Client exposure	Do not expose API keys in frontend code
Repository safety	Do not commit API keys to source control
Rotation	Rotate keys after suspected exposure or integration changes
Ownership	Assign keys to controlled service environments where possible

Operational Guidance

Where should API keys be stored?

Store API keys in environment variables, deployment secrets, or a managed secrets service. Do not hardcode keys in application source code.

Can API keys be used in frontend code?

No. API keys should only be used from trusted backend services. Frontend applications should call your backend, and your backend should call WriterzRoom.

When should keys be rotated?

Rotate keys after suspected exposure, employee offboarding, vendor changes, access policy changes, or integration cleanup.

What causes authentication failure?

Authentication can fail when the key is missing, expired, malformed, invalid, sent without the Bearer prefix, or used from a plan that does not include API access.

Do not send API keys in query parameters. Always use the Authorization header.

Generate Content

Submit a generation request through the API.

Endpoints Reference

Review available API endpoints and expected responses.