Authentication

API keys

Production keys have the rndr_live_ prefix followed by a random string. Each key belongs to an organization; a render made with it counts toward that organization’s monthly quota and is recorded in its usage history. You create, list and revoke keys in the Dashboard.

How to send the key

Renderly accepts two equivalent headers. Use either one — pick whichever fits your HTTP client best.

Option A — Authorization: Bearer

The industry standard. Prefix the key with Bearer .

curl -X POST https://api.renderly.dev/v1/render \
  -H "Authorization: Bearer rndr_live_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "html": "<h1>hi</h1>" }' --output out.pdf

Option B — X-API-Key

A dedicated header, no prefix. Handy when the client already uses Authorization for something else, or with gateways that reserve that header.

curl -X POST https://api.renderly.dev/v1/render \
  -H "X-API-Key: rndr_live_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "html": "<h1>hi</h1>" }' --output out.pdf

Key security

The rndr_live_ grants full access to your organization. Treat it like a password.

// Read from the environment; never hardcode the key in your code.
const RENDERLY_KEY = process.env.RENDERLY_API_KEY

const res = await fetch("https://api.renderly.dev/v1/render", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${RENDERLY_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ template: "invoice", data: { total: "$99.00" } }),
})

Revocation and rotation

Revoking a key is instant: from the moment of revocation, any request made with it gets a 401 invalid_api_key. To rotate without downtime: generate the new key, update your secrets, deploy, and only then revoke the old one.

Authentication errors

Auth failures return a 401 with a JSON body in the format { error: { code, message } }.

No key — missing_api_key

Neither header was sent.

{
  "error": {
    "code": "missing_api_key",
    "message": "Send your API key in Authorization: Bearer ..."
  }
}

Invalid or revoked key — invalid_api_key

The key doesn’t exist, is malformed or has been revoked.

{
  "error": {
    "code": "invalid_api_key",
    "message": "Invalid or revoked API key."
  }
}

The full list of API errors is on the Errors page.