Authentication & Security

Everything you need to authenticate to the Imagen API, keep your credentials safe, and answer the questions your security team is most likely to ask.

Authentication

The Imagen API authenticates every request with an API key. The base URL is:

Send your key in the x-api-key header on every request. There is no OAuth, bearer-token, or login step for the API — the key alone identifies your account.

curl 'https://api.imagen-ai.com/v1/profiles/' \
  --header 'x-api-key: $IMAGEN_API_KEY'

import asyncio, os
from imagen_sdk import ImagenClient

async def main():
    async with ImagenClient(os.environ["IMAGEN_API_KEY"]) as client:
        profiles = await client.get_profiles()
        print(profiles)

asyncio.run(main())

import { ImagenClient } from 'imagen-ai-sdk';

const client = new ImagenClient(process.env.IMAGEN_API_KEY!);
try {
  const profiles = await client.getProfiles();
  console.log(profiles);
} finally {
  await client.close();
}

// go get github.com/imagenai/imagen-ai-sdk/sdks/go
import imagen "github.com/imagenai/imagen-ai-sdk/sdks/go"

client, err := imagen.NewClient(os.Getenv("IMAGEN_API_KEY"))
if err != nil {
    log.Fatal(err)
}

profiles, _ := client.GetProfiles(context.Background())
fmt.Println(profiles)

import java.net.URI;
import java.net.http.*;

var request = HttpRequest.newBuilder()
.uri(URI.create("https://api.imagen-ai.com/v1/profiles/"))
.header("x-api-key", System.getenv("IMAGEN_API_KEY"))
.GET()
.build();
var response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());

require 'net/http'
require 'json'
require 'uri'

uri = URI("https://api.imagen-ai.com/v1/profiles/")
req = Net::HTTP::Get.new(uri)
req['x-api-key'] = ENV['IMAGEN_API_KEY']

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
data = JSON.parse(res.body)['data']

<?php
$ch = curl_init('https://api.imagen-ai.com/v1/profiles/');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'x-api-key: ' . getenv('IMAGEN_API_KEY'),
],
]);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true)['data'];

using System.Net.Http;

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key",
Environment.GetEnvironmentVariable("IMAGEN_API_KEY"));

var response = await client.GetAsync("https://api.imagen-ai.com/v1/profiles/");
var json = await response.Content.ReadAsStringAsync();

You generate and manage your key from your Imagen account. See Onboarding for where to create it. Keys are scoped to your account — a key only ever sees your own profiles, projects, and images.

Keeping your API key safe

Your API key grants full access to your account. Treat it like a password:

• Keep it server-side. Never ship your key in browser JavaScript, mobile apps, or any client a user can inspect.
• Load it from the environment. Read it from an environment variable or a secret manager ($IMAGEN_API_KEY in the examples above) — don’t hardcode it.
• Never commit it. Keep keys out of source control, logs, screenshots, and support tickets.
• Rotate periodically, and rotate immediately if a key may have been exposed.
• Revoke on leak. If a key leaks, revoke it right away and issue a new one.

Transport security

All API traffic is encrypted in transit with HTTPS (TLS 1.2 or higher). Plain-HTTP requests are not accepted. Image uploads go directly to private storage through pre-signed, time-limited URLs, so your files are never exposed publicly during transfer.

Authentication errors

For the full list of API errors, see Errors.

Security & data handling

Security and privacy are core to how Imagen is built. These are the questions we hear most often from customers and their security teams.

Where is my data stored?

Customer data is hosted on Amazon Web Services (AWS) in the United States — primary storage and processing in US East, with disaster-recovery redundancy in US West. All storage buckets are private; nothing is publicly accessible.

Do you use my photos to train AI models?

No. Your uploaded content is not used to train any shared, general, or foundational model, and it is never used across accounts. AI Profiles are trained per account and only when you opt in — a profile learns your editing style for your own use and nothing else. Face detection is anonymous and opt-in; no biometric templates are stored.

How long do you keep my images?

Full-resolution uploaded images are hard-deleted within 7 days by default — this is a permanent deletion, not a soft delete, and the images cannot be recovered afterward. If you close your account, your AI Profile and any stored data are removed approximately three months after termination.

How is my data encrypted?

Data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Uploads move directly to private storage over pre-signed, time-limited URLs.

Who can access my data?

You own your data. By default, Imagen staff do not access customer data — we run a Zero Trust model with multi-factor authentication, role-based access control, and full audit logging. Access is limited to cases where you request support that requires it, or where we are legally obligated, and every such access is logged and auditable.

Do you have SOC 2 or ISO 27001?

Imagen does not currently hold SOC 2 or ISO 27001 certifications. The API runs on AWS, which maintains those certifications at the infrastructure layer, and we back that with internal and third-party security reviews.

Need more detail?

We maintain a full Security & Compliance overview and a Data Processing Agreement (DPA) that we can share with your team on request. Reach out through support.imagen-ai.com and we’ll get it to you.