Credentials

When you interact with the ImpossibleFX platform programmatically, you use security credentials to prove your identity. There are two types of credentials depending on what you’re doing.

Account access

Your email and password give you access to the Console, where you manage projects, templates, and account settings.

API access

For programmatic access to the management API, you use an API Key. It is a single credential — there is no separate secret to manage — and it is independent of your account password.

Getting your API key

Log in to the Console.
Go to Account Settings > API Keys.
Click Create API Key.
Optionally add a comment to help you identify the key later, for example Production Server or CI/CD Pipeline.
Copy the API Key immediately.

! Warning

Your API Key is shown only once, when you create it. ImpossibleFX does not store it in plain text and cannot recover it. If you lose a key, create a new one and delete the old one.

Using your API key

Send the API Key as a Bearer token in the Authorization header of every request:

Authorization: Bearer YOUR_API_KEY

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://api-eu-west-1.impossible.io/v1/list/project

The SDKs take the same key and set the header for you — see SDKs.

When credentials are required

Not all API calls require credentials:

Action	Credentials needed?
Making render requests	No
Making render requests against a project that requires authentication	Yes
Retrieving rendered videos	No
Managing projects via API	Yes
Managing templates via API	Yes
Accessing account settings	Yes

i Note

By default, render requests only need your Project ID, not API credentials. This makes it safe to render videos from client-side code without exposing an API Key.

Projects that require authentication

Authentication for render requests is off by default and enabled per project. Turn it on when you create the project, or later in the Console on the project’s Publish > Distribution panel, under Require authentication for render requests.

While it is on, the project rejects every unauthenticated render request with 403 Forbidden, so each request has to carry your API Key:

curl -X POST -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"movie": "welcome-video", "params": {"name": "Alex"}}' \
  https://render-eu-west-1.impossible.io/v2/render/YOUR_PROJECT_ID

! Warning

Turning this on affects a live project immediately — anything already rendering without credentials starts getting 403. It also means the API Key has to reach wherever the render request is made from, so avoid it for renders triggered directly from client-side code.

Managing keys

The API Keys page lists every key on your account with its comment and creation date. Delete a single key with the button in its row, or select several and use Delete Selected. Deleting a key takes effect immediately — any application still using it will start getting 401 Unauthorized.

Key rotation

Rotate your API keys regularly as a security best practice:

Create a new key.
Update your application to use it.
Verify everything works.
Delete the old key.

You can have multiple active keys at once, which makes zero-downtime rotation straightforward.