Authentication

API Key Types

The Logo API supports two key types:

pk_live_1234567890abcdef    ← publishable (client-safe)
sk_live_abcdef1234567890    ← secret (server-side only)

Getting a Key

1. Sign in to the customer portal.
2. Open API Keys.
3. Create or copy a publishable key (pk_*).
4. (Optional) Add domain restrictions.

Keys can be rotated or revoked in the portal. There is no public secret-key API for key management.

Using Your Key

Publishable Keys (Client-Side)

Pass the key as a token query parameter:

<img
  src="https://logos.getquikturn.io/apple.com?token=pk_your_key"
  alt="Apple logo"
/>

const apiKey = process.env.LOGO_API_KEY; // pk_*
const domain = 'apple.com';
const res = await fetch(`https://logos.getquikturn.io/${domain}?token=${apiKey}`);

import os, requests

api_key = os.getenv("LOGO_API_KEY")  # pk_*
domain = "apple.com"
res = requests.get(f"https://logos.getquikturn.io/{domain}?token={api_key}")
res.raise_for_status()

import { QuikturnLogos } from "@quikturn/logos/client";

const client = new QuikturnLogos({ token: "pk_live_xxx" });
const { url } = await client.get("apple.com");

Secret Keys (Server-Side)

Secret keys use the Authorization: Bearer header and are only available in the server SDK:

import { QuikturnLogos } from "@quikturn/logos/server";

const client = new QuikturnLogos({
  secretKey: process.env.QT_SECRET_KEY!, // sk_*
});

const { buffer } = await client.get("apple.com", { size: 1200 });

Secret keys unlock:

• Higher resolution logos (up to 1200px vs 800px)
• Batch operations via client.getMany()
• Streaming via client.getStream()
• Authorization header authentication (token not in URL)

Domain Restrictions

You can bind a key to specific domains. When enabled, the worker validates Origin (preferred) or Referer against your allowlist.

Adding Allowed Domains

1. In API Keys, edit the key and add allowed domains (one per line):

   example.com
   app.example.com
   *.example.com

2. Save changes and redeploy your app with the same key.

Matching Rules

• Exact hostnames are matched (e.g., example.com).
• Wildcards (*.example.com) match any subdomain on that root.
• Local development should include the host and port (e.g., localhost:3000).

Security Best Practices

• Store keys in environment variables; never hardcode production keys.
• Rotate keys periodically; update your app before revoking the old key.
• Keep separate keys per environment (dev, staging, production).
• Monitor usage and attribution status in the portal; Free keys must maintain attribution to avoid 403s.

Troubleshooting

• 401 Unauthorized: Missing token, token not starting with pk_, or revoked key.
• 403 Forbidden: Domain restrictions failed or attribution required for Free tier.
• 429 Too Many Requests: Per-minute rate limit reached; respect Retry-After.

Need more? Check Rate Limits, Errors, and SDK Documentation.