What is an Auth Key?
An Auth Key is the public identifier for a Transloadit Workspace and functions similarly to a username in automated requests. It identifies the Workspace a request runs under but does not independently prove that the sender is authorized.
How Auth Keys work
The Auth Key selects the Workspace under which an API operation is evaluated and billed. Proof of authorization comes from a signature derived with the paired Auth Secret: Transloadit validates a signature whenever one is supplied and rejects unsigned requests only where Signature Authentication has been made mandatory. This public-versus-secret distinction lets clients reference the Workspace without embedding the signing secret. Integration logs may retain the key for diagnosis, but authorization decisions must never rely on possession of it alone.
Key facts
- An Auth Key can be sent with client-visible request data because it identifies a Workspace; exposing the paired Auth Secret would instead permit unauthorized signing.
- When Signature Authentication is not enforced, a request carrying a different valid Auth Key is attributed to the Workspace that key identifies rather than failing, and usage is billed there. A signature that does not match the paired secret is rejected as INVALID_SIGNATURE.
- Access controls should distinguish Workspace identification from request integrity: the key supplies the former, the computed signature and its parameters supply the latter, and enabling Signature Authentication makes the integrity check mandatory.
When Auth Keys matter
Include the Auth Key when an integration must associate an automated request with the correct Workspace. Because it is public, pair it with a request signature: Signature Authentication is strongly recommended and becomes mandatory when the Workspace or Template requires it.