Authentication

BastosConvert uses Bearer API keys. Pass your key in the Authorization header:

Authorization: Bearer bsc_live_xxxxxxxxxxxxxxxxxxxx

What needs a key

The instant tools are open so you can try them in seconds. A key unlocks the asynchronous conversion jobs pipeline (per-account history, the queued /convert entry point) and higher limits.

Getting a key

Generate and revoke keys from your account (API keys are part of Pro). Each key is shown once at creation — store it then; it can't be retrieved later, only rotated.

Using it

curl https://bastosconvert.com/api/v1/conversion_jobs \
  -H "Authorization: Bearer bsc_live_xxxxxxxxxxxxxxxxxxxx"

A missing or invalid key returns 401:

{ "type": "https://bastos-cms.dev/errors/auth_required",
  "title": "auth_required", "status": 401, "code": "auth_required" }

Job reads are owner-scoped — a key only ever sees its own account's conversions.

Keeping keys safe

• Server-side only. Never ship a bsc_live_… key in client-side code, a mobile app bundle, or a public repo — anyone with the key can spend your quota.
• Rotate on exposure. If a key leaks, revoke it from your account and mint a new one; revocation is immediate.
• Scope keys per integration so you can revoke one without breaking the others.