Skip to main content
LocalAds API keys belong to one organization. The key determines which organization’s brands and resources a request can access, so requests never accept an organization ID. Brand-owned collection requests use brand_id.

​
Send the key

Include the key in the Authorization header using the bearer scheme:

​
Keep keys safe

  • Store keys in a secrets manager or server environment variable.
  • Never put a key in browser code, mobile binaries, logs, or source control.
  • Never send a key in a URL or query parameter.
  • Revoke and replace a key immediately if it is exposed.
The full secret is displayed only when the key is created. LocalAds stores a hash and cannot show the secret again.

​
Permissions

Permissions are explicit. Product operations use these permissions: The photoshoots:generate permission includes reading the templates required for generation and retrieving the resulting photoshoot. A valid key without the required permission receives 403 Forbidden. A missing, disabled, expired, or invalid key receives 401 Unauthorized.

​
Rate limits

API keys have a broad per-key limit of 120 requests per minute. A rate-limited request returns 429 Too Many Requests with a Retry-After header.
Last modified on July 24, 2026