What is an Auth Key?
An Auth Key is the public identifier for a Transloadit Workspace and functions similarly to a username in automated requests. It identifies the Workspace a request runs under but does not independently prove that the sender is authorized.
How Auth Keys work
The Auth Key selects the Workspace under which an API operation is evaluated and billed. Proof of authorization comes from a signature derived with the paired Auth Secret: Transloadit validates a signature whenever one is supplied and rejects unsigned requests only where Signature Authentication has been made mandatory. This public-versus-secret distinction lets clients reference the Workspace without embedding the signing secret. Integration logs may retain the key for diagnosis, but authorization decisions must never rely on possession of it alone.
Key facts
- 1An Auth Key can be sent with client-visible request data because it identifies a Workspace; exposing the paired Auth Secret would instead permit unauthorized signing.
- 2When Signature Authentication is not enforced, a request carrying a different valid Auth Key is attributed to the Workspace that key identifies rather than failing, and usage is billed there. A signature that does not match the paired secret is rejected as INVALID_SIGNATURE.
- 3Access controls should distinguish Workspace identification from request integrity: the key supplies the former, the computed signature and its parameters supply the latter, and enabling Signature Authentication makes the integrity check mandatory.
When Auth Keys matter
Include the Auth Key when an integration must associate an automated request with the correct Workspace. Because it is public, pair it with a request signature: Signature Authentication is strongly recommended and becomes mandatory when the Workspace or Template requires it.
Common use cases for platform workflows
These examples cover platform workflows broadly, not specifically Auth Keys.
- Running repeatable upload, import, processing, AI, storage, and notification pipelines.
- Tracking long-running media work independently from an application request.
- Referencing centrally stored credentials by name instead of sending storage secrets with each request.
Working with platform workflows
This guidance covers platform workflows broadly, not just Auth Keys.
A client authenticates and submits files or references together with workflow instructions. The platform validates the request, schedules dependent operations, records state transitions, and exposes results through a response, polling endpoint, or notification.
Platform concepts become reliable only when their lifecycle is explicit. Authentication, idempotency, retries, timeouts, observability, quotas, and terminal states should be designed together rather than added after failures occur.
What you gain
- Reusable workflows separate application intent from processing infrastructure.
- Stable job identifiers and lifecycle events improve observability and recovery.
- Managed queues and workers let products scale without embedding every media tool.
What it costs
- Synchronous responses are simple but keep connections open while long work executes.
- Aggressive retries improve recovery from transient faults but can duplicate work or overload a dependency.
- Higher concurrency reduces queue time until resource contention or a downstream limit becomes the bottleneck.
Before production
- 1Define authentication, authorization, idempotency, retries, and terminal error behavior.
- 2Observe queue time, execution time, callbacks, and partial results with stable identifiers.
- 3Exercise malformed, duplicate, interrupted, and unauthorized requests before launch.