API Authentication - WriterzRoom

WriterzRoom API requests use Bearer token authentication. API keys are generated from the product settings area on supported plans and supplied in the Authorization header for each request.

Authorization: Bearer YOUR_API_KEY

Authentication Overview

Authenticate

Send a Bearer token with every protected request.

Protect

Store keys in secure server-side environments.

Rotate

Replace keys after exposure or access changes.

Audit

Track usage through generation and content records.

When Authentication Applies

API authentication is required for integrations that create content, check generation status, retrieve saved content, or access account-level configuration programmatically.

Applications

Embed WriterzRoom generation inside products, portals, dashboards, and internal tools.

Automation

Connect structured content workflows to editorial systems, campaign operations, and backend jobs.

Enterprise Operations

Support governed content workflows where access control, usage tracking, and auditability matter.

Request Header

Every authenticated request should include these headers.

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Example Request

curl -X POST https://api.writerzroom.com/api/generate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "template_id": "blog_article_generator",
    "style_profile_id": "general_blog",
    "generation_mode": "standard",
    "vertical_id": "saas_tech",
    "user_input": {
      "topic": "The future of AI in content marketing",
      "target_audience": "Marketing directors at B2B SaaS companies",
      "objective": "Educate on practical AI adoption strategies"
    }
  }'

Authentication Flow

Generate an API key

Go to Settings → API access and create a new API key for your integration.

Copy the key once

Copy the key immediately. For security, it may not be shown again after creation.

Store it securely

Save the key in an environment variable, deployment secret, or managed secrets service.

Send the Bearer token

Add the key to every API request using the Authorization header.

What an API Key Cannot Do

An API key is a single long-lived credential that never passes through two-factor authentication, so it cannot change the account that owns it. Requests made with an API key receive 403 Forbidden from:

API key management: listing, creating, or revoking keys
Two-factor authentication setup, verification, and removal
Signed-in device management
Account profile lookup and account deletion
Administrative endpoints

Manage these from the signed-in web app. When two-factor authentication is turned on for the account, creating an API key, changing two-factor settings, and deleting the account also require that the current sign-in completed its second factor.

How the Web App Reaches the API

The WriterzRoom web app does not use your API keys or a shared secret to act on your behalf. For each request it makes to the API, the web app’s server signs a token that names your account, records whether your sign-in completed two-factor authentication, and expires after 60 seconds. The API verifies that signature with a public key and accepts no other form of web-app identity. Your browser never receives the signing key.

Key Management Guidance

Practice	Guidance
Storage	Use environment variables, deployment secrets, or managed secret stores
Client exposure	Do not expose API keys in frontend code
Repository safety	Do not commit API keys to source control
Rotation	Rotate keys after suspected exposure or integration changes
Ownership	Assign keys to controlled service environments where possible

Operational Guidance

Where should API keys be stored?

Store API keys in environment variables, deployment secrets, or a managed secrets service. Do not hardcode keys in application source code.

Can API keys be used in frontend code?

No. API keys should only be used from trusted backend services. Frontend applications should call your backend, and your backend should call WriterzRoom.

When should keys be rotated?

Rotate keys after suspected exposure, employee offboarding, vendor changes, access policy changes, or integration cleanup.

What causes authentication failure?

Authentication can fail when the key is missing, malformed, invalid, revoked, sent without the Bearer prefix, or used from an account that no longer has eligible API access.

Do not send API keys in query parameters. Always use the Authorization header.

Generate Content

Submit a generation request through the API.

Endpoints Reference

Review available API endpoints and expected responses.

​Authentication Overview

Authenticate

Protect

Rotate

Audit

​When Authentication Applies

Applications

Automation

Enterprise Operations

​Request Header

​Example Request

​Authentication Flow

​What an API Key Cannot Do

​How the Web App Reaches the API

​Key Management Guidance

​Operational Guidance

Generate Content

Endpoints Reference

Authentication Overview

When Authentication Applies

Request Header

Example Request

Authentication Flow

What an API Key Cannot Do

How the Web App Reaches the API

Key Management Guidance

Operational Guidance