This API uses API key authentication for all data operations (/assets and /asset-lists). The /generate-api-key endpoint uses JWT Bearer token authentication (used by the web application to create API keys).

API Key Authentication

API keys provide secure, long-lived access to the API without requiring user credentials. This is the primary authentication method for integrations, scripts, and third-party applications.

Obtaining an API Key

1. Log in to your account at the web application
2. Navigate to Settings → API Keys
3. Click Generate New API Key
4. Give your key a descriptive name (optional but recommended)
5. Copy the key immediately — it will only be displayed once
6. Store the key securely (e.g., in environment variables or a secrets manager)

Using API Keys

Include your API key in the apikey header with every request:

curl -X GET 'https://api.testassets.io/v1/assets' \
  -H 'apikey: sk_live_1234567890abcdef...' \
  -H 'Content-Type: application/json'

JavaScript Example:

const response = await fetch('https://api.testassets.io/v1/assets', {
  headers: {
    'apikey': 'sk_live_1234567890abcdef...',
    'Content-Type': 'application/json'
  }
});
const assets = await response.json();

Python Example:

import requests

headers = {
    'apikey': 'sk_live_1234567890abcdef...',
    'Content-Type': 'application/json'
}
response = requests.get(
    'https://api.testassets.io/v1/assets',
    headers=headers
)
assets = response.json()

Note: The /assets and /asset-lists endpoints accept only API key authentication. JWT Bearer tokens and the anonymous key are not accepted on these endpoints.

• Never commit API keys to version control (Git, SVN, etc.)
• Use environment variables to store keys in your applications
• Rotate keys regularly as part of your security hygiene
• Revoke compromised keys immediately from the Settings page
• Use different keys per environment (development, staging, production)
• Always use HTTPS — never send credentials over HTTP

The API returns standardized JSON error responses:

{
  "message": "Error description",
  "code": "ERROR_CODE"
}

Common error codes:

• Default limit: 100 requests per minute per API key
• Exceeded limits return 429 Too Many Requests
• Rate limit headers included in all responses:
  • X-RateLimit-Limit: Maximum requests allowed per minute
  • X-RateLimit-Remaining: Requests remaining in current window
  • X-RateLimit-Reset: Unix timestamp when the limit resets

The GET endpoints support the following query parameters:

select

Specify which fields to return. Default: all fields.

Assets: id, name, comment, created_at, updated_at, list_id, parent_id, user_id

Asset Lists: id, title, description, created_at, updated_at, user_id

Example: ?select=id,name,created_at

search (Assets only)

Filter assets by name or notes/comment using a case-insensitive partial match.

Example: ?search=login returns all assets whose name or notes contain "login".

order

Sort results by a field with direction.

Assets: name, created_at, updated_at

Asset Lists: title, created_at, updated_at

Example: ?order=created_at.desc

limit

Limit the number of results (max 1000). Example: ?limit=50

Viewing Your Keys

Navigate to Settings → API Keys to see all active keys with their name, prefix, creation date, and last used date.

Revoking Keys

Click Revoke next to any key. Revoked keys are immediately invalidated and applications using them will receive 401 errors.

The full API key value is never stored or displayed again after initial creation for security reasons.

CRUD operations for individual assets. Requires API key authentication.

CRUD operations for asset list collections. Requires API key authentication.

API key management. The generate endpoint requires JWT Bearer token authentication.