# Authentication

Authenticate requests with the API key associated with your Pipispy Open Platform account.

## Manage your API key

[Open the dashboard](/dashboard) to find and manage your API key. Store it in a server-side environment variable or your application's secret store.

## JSON requests

Most data endpoints accept a JSON body with three fields:

| Field | Type | Description |
| --- | --- | --- |
| key | string | Your Open Platform API key. |
| uri | string | The endpoint path specified in the reference documentation. |
| params | object | The endpoint's request parameters. |

```json
{
  "key": "YOUR_API_KEY",
  "uri": "/v3/api/open/adspy/list",
  "params": {
    "current_page": 1,
    "page_size": 10
  }
}
```

Send `Content-Type: application/json` and `Accept: application/json`. The key is passed in the body, not as a Bearer token.

## Choose the correct gateway

| Gateway | Usage |
| --- | --- |
| https://www.pipispy.com/open-api/v1/data | Standard data queries and image URL search submission. |
| https://www.pipispy.com/open-api/v1/monitor/data | Ad monitoring endpoints. |
| https://www.pipispy.com/open-api/v1/upload-file | Multipart image upload. |

Always use the URL and request format in the specific endpoint documentation. [Image upload](/doc/ai-search-image-submit) has a different body format from JSON queries.

## Keep keys private

Make API calls from your server. Keep keys out of URLs, client-side bundles, source control, and logs. If a key is exposed, replace it through the account tools available in your dashboard or contact support.