Skip to main content
LocalAds API keys belong to one organization. The key determines which organization’s brands and resources a request can access, so requests never accept an organization ID. Brand-owned collection requests use brand_id.

​
Send the key

Include the key in the Authorization header using the bearer scheme:

​
Keep keys safe

  • Store keys in a secrets manager or server environment variable.
  • Never put a key in browser code, mobile binaries, logs, or source control.
  • Never send a key in a URL or query parameter.
  • Revoke and replace a key immediately if it is exposed.
The full secret is displayed only when the key is created. LocalAds stores a hash and cannot show the secret again.

​
Permissions

Permissions are explicit. Product operations use these permissions: The campaigns:generate permission includes creating a campaign and retrieving its generated creatives. The photoshoots:generate permission includes reading the templates required for generation and retrieving resulting photoshoots and product creatives. The images:upload permission uploads reusable images for products, Quick Shoots, and templates. Keys created before image uploads were introduced must be replaced if they do not include this permission. A valid key without the required permission receives 403 Forbidden. A missing, disabled, expired, or invalid key receives 401 Unauthorized. Permissions are fixed when a key is created. Replace an older key if it does not include a newly required permission.

​
Rate limits

API keys have a broad per-key limit of 120 requests per minute. A rate-limited request returns 429 Too Many Requests with a Retry-After header.
Last modified on August 5, 2026