Authentication

API-key authentication is opt-in per deployment (AUTH_ENABLED=true). When enabled, every request except /health and /ready must include a valid key.

Providing a key

Use either header:

Authorization: Bearer <your-api-key>

x-api-key: <your-api-key>

Example

curl -H "Authorization: Bearer sk_live_..." \
  "https://image-optimizer-two.vercel.app/img/raw.githubusercontent.com/github/explore/main/topics/nodejs/nodejs.png?f=webp"

Bypass paths

/health and /ready always bypass authentication so uptime monitors and load balancers can reach them without a key.