Authentication

Every request carries your key in the X-API-Key header. There are no tokens to refresh and no login round-trip.

curl 'https://api.gapi.dev/instagram?url=…' \
  -H 'X-API-Key: gapi_live_your_key_here'

Getting a key

Create one in the dashboard. You can hold up to five at once.

Keeping it safe

Treat the key like a password: keep it on your server, in an environment variable. Never put it in a mobile app, a browser bundle or a public repository — anything shipped to a user can be read by that user.

Rotating without downtime

Holding several keys is what makes rotation painless. Create the new one, deploy it, confirm traffic has moved, then revoke the old. Nothing goes dark in between.

Revoking

Revoking takes effect immediately — the next call with that key gets 401. Revoked keys stay listed in your dashboard so their usage history is not lost.

What can go wrong