Authentication
All API requests require authentication using an API key. Include your key in the X-API-Key header.
Getting Your API Key
- 1Create an account or sign in if you already have one.
- 2Go to your Dashboard.
- 3Click "Generate API Key" to create your key.
- 4Copy your key and store it securely. You won't be able to see it again.
Using Your API Key
Include your API key in the X-API-Key header with every request:
Request Headerhttp
X-API-Key: yt_sub_your_api_key_hereExample Request
curlbash
curl -X POST https://api.ytsubs.dev/api/v1/extract \
-H "Content-Type: application/json" \
-H "X-API-Key: yt_sub_your_api_key_here" \
-d '{"url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ"}'API Key Format
API keys follow this format:
yt_sub_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx- •
yt_sub_prefix identifies it as a SubKit API key - •Followed by 32 random alphanumeric characters
- •Total length: 39 characters
Security Best Practices
Keep your API key secret
Never share your API key publicly or commit it to version control. Anyone with your key can make requests on your behalf.
- ✓Store your API key in environment variables
- ✓Use
.envfiles for local development (add to.gitignore) - ✓Use secrets management in production (e.g., Vercel, Railway, AWS Secrets)
- ✓Regenerate your key immediately if it's exposed
- ✗Never include your API key in client-side code
- ✗Never commit your API key to Git repositories
Authentication Errors
If authentication fails, you'll receive a 401 Unauthorized response:
Error Responsejson
{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid or missing API key",
"docs_url": "/docs/errors#unauthorized"
}
}Common causes:
- •Missing
X-API-Keyheader - •Typo in the API key
- •Key was regenerated (old key no longer valid)
- •Key was revoked
See the error reference for more details.
Regenerating Your Key
If your API key is compromised or you need a new one:
- 1Go to your Dashboard
- 2Click "Regenerate Key"
- 3Copy your new key and update your applications
Warning
Regenerating your key immediately invalidates the old one. All requests using the old key will fail with a 401 error.