---
title: "Authentication & Security"
description: "How to authenticate to the Imagen API with your x-api-key, how to keep keys safe, and answers to common questions about data storage, retention, encryption, and access."
canonical: https://api-docs.imagen-ai.com/docs/reference/authentication/
last-updated: 2026-08-27
---

# Authentication & Security

Everything you need to authenticate to the Imagen API, keep your credentials
safe, and answer the questions your security team is most likely to ask.

## Authentication

The Imagen API authenticates every request with an API key. The base URL is:

`BASE https://api.imagen-ai.com/v1/`

Send your key in the `x-api-key` header on every request. There is no OAuth,
bearer-token, or login step for the API - the key alone identifies your account.

`HEADER x-api-key: YOUR_API_KEY`

```curl
curl 'https://api.imagen-ai.com/v1/profiles/' \
  --header 'x-api-key: $IMAGEN_API_KEY'
```

```python
import asyncio, os
from imagen_sdk import ImagenClient

async def main():
    async with ImagenClient(os.environ["IMAGEN_API_KEY"]) as client:
        profiles = await client.get_profiles()
        print(profiles)

asyncio.run(main())
```

```typescript
import { ImagenClient } from 'imagen-ai-sdk';

const client = new ImagenClient(process.env.IMAGEN_API_KEY!);
try {
  const profiles = await client.getProfiles();
  console.log(profiles);
} finally {
  await client.close();
}
```

```go
// go get github.com/imagenai/imagen-ai-sdk/sdks/go

client, err := imagen.NewClient(os.Getenv("IMAGEN_API_KEY"))
if err != nil {
    log.Fatal(err)
}

profiles, _ := client.GetProfiles(context.Background())
fmt.Println(profiles)
```

```java
import java.net.URI;

var request = HttpRequest.newBuilder()
.uri(URI.create("https://api.imagen-ai.com/v1/profiles/"))
.header("x-api-key", System.getenv("IMAGEN_API_KEY"))
.GET()
.build();
var response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
```

```ruby
require 'net/http'
require 'json'
require 'uri'

uri = URI("https://api.imagen-ai.com/v1/profiles/")
req = Net::HTTP::Get.new(uri)
req['x-api-key'] = ENV['IMAGEN_API_KEY']

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
data = JSON.parse(res.body)['data']
```

```php
<?php
$ch = curl_init('https://api.imagen-ai.com/v1/profiles/');
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'x-api-key: ' . getenv('IMAGEN_API_KEY'),
],
]);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true)['data'];
```

```csharp
using System.Net.Http;

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key",
Environment.GetEnvironmentVariable("IMAGEN_API_KEY"));

var response = await client.GetAsync("https://api.imagen-ai.com/v1/profiles/");
var json = await response.Content.ReadAsStringAsync();
```

You generate and manage your key from your Imagen account. See
[Onboarding](/docs/onboarding#get-started) for where to create it. Keys are
scoped to your account - a key only ever sees your own profiles, projects, and
images.

> **Web app sign-in is separate** The Imagen web and desktop apps use passwordless sign-in (a one-time code sent to your email, then a short-lived session token). That flow is for the apps only - API integrations always authenticate with the `x-api-key` header shown above.

## Keeping your API key safe

Your API key grants full access to your account. Treat it like a password:

- **Keep it server-side.** Never ship your key in browser JavaScript, mobile
apps, or any client a user can inspect.
- **Load it from the environment.** Read it from an environment variable or a
secret manager (`$IMAGEN_API_KEY` in the examples above) - don't hardcode it.
- **Never commit it.** Keep keys out of source control, logs, screenshots, and
support tickets.
- **Rotate periodically**, and rotate immediately if a key may have been
exposed.
- **Revoke on leak.** If a key leaks, revoke it right away and issue a new one.

> **Never expose your key in client-side code** Anything sent to a browser or mobile device can be read by the user. Always call the Imagen API from your own backend and keep the key there.

## Transport security

All API traffic is encrypted in transit with **HTTPS (TLS 1.2 or higher)**.
Plain-HTTP requests are not accepted. Image uploads go directly to private
storage through pre-signed, time-limited URLs, so your files are never exposed
publicly during transfer.

## Authentication errors

| Status | Meaning | Fix |
| --- | --- | --- |
| 401 | Missing or invalid API key. | Send a valid key in the `x-api-key` header. |
| 403 | The key is valid but not allowed to access this resource. | Use a key that owns the profile or project you're requesting. |

For the full list of API errors, see [Errors](/docs/reference/errors).

## Security & data handling

Security and privacy are core to how Imagen is built. These are the questions we
hear most often from customers and their security teams.

### Where is my data stored?

Customer data is hosted on Amazon Web Services (AWS) in the **United States** -
primary storage and processing in US East, with disaster-recovery redundancy in
US West. All storage buckets are private; nothing is publicly accessible.

### Do you use my photos to train AI models?

No. Your uploaded content is **not** used to train any shared, general, or
foundational model, and it is never used across accounts. AI Profiles are
trained **per account and only when you opt in** - a profile learns your editing
style for your own use and nothing else. Face detection is anonymous and opt-in;
no biometric templates are stored.

### How long do you keep my images?

Full-resolution uploaded images are **hard-deleted within 7 days** by default -
this is a permanent deletion, not a soft delete, and the images cannot be
recovered afterward. If you close your account, your AI Profile and any stored
data are removed approximately three months after termination.

### How is my data encrypted?

Data is encrypted **in transit with TLS 1.2+** and **at rest with AES-256**.
Uploads move directly to private storage over pre-signed, time-limited URLs.

### Who can access my data?

You own your data. By default, Imagen staff **do not access customer data** - we
run a Zero Trust model with multi-factor authentication, role-based access
control, and full audit logging. Access is limited to cases where you request
support that requires it, or where we are legally obligated, and every such
access is logged and auditable.

### Do you have SOC 2 or ISO 27001?

Imagen does not currently hold SOC 2 or ISO 27001 certifications. The API runs
on AWS, which maintains those certifications at the infrastructure layer, and we
back that with internal and third-party security reviews.

### Need more detail?

We maintain a full Security & Compliance overview and a Data Processing
Agreement (DPA) that we can share with your team on request. Reach out through
[support.imagen-ai.com](https://support.imagen-ai.com/hc/en-us) and we'll get it
to you.