Authenticate with the Bugsmash API

The Bugsmash API uses API key authentication. Every request must include your API key in the X-API-Key request header. There are no session tokens, OAuth flows, or cookies — just a single header on every call.

Getting your API key

Go to tools.bugsmash.io and sign in to your account.

Open account settings

Click your profile avatar or name in the top-right corner and select Settings.

Copy your API key

Find the API Key section and copy your key. Treat this key like a password — do not commit it to source control or expose it in client-side code.

Using your API key

Pass your API key in the X-API-Key header on every request:

curl --location 'https://api.bugsmash.io/api/v2/projects' \
--header 'X-API-Key: YOUR_API_KEY'

Never expose your API key in front-end JavaScript, mobile apps, or public repositories. If your key is compromised, regenerate it immediately from your account settings.

Authentication errors

If your API key is missing or invalid, the API returns an HTTP 401 Unauthorized response:

{
  "status": false,
  "message": "Unauthenticated."
}

If you see this error, verify that:

The X-API-Key header is present on the request
The value matches exactly what is shown in your account settings
The key has not been regenerated since you last copied it

Content-Type header

Most endpoints also require a Content-Type header alongside X-API-Key:

Use application/json for JSON request bodies
Use multipart/form-data for file upload endpoints (the boundary is set automatically by your HTTP client)

# JSON request
curl --location 'https://api.bugsmash.io/api/v2/folder' \
--header 'X-API-Key: YOUR_API_KEY' \
--header 'Content-Type: application/json' \
--data '{"name": "My Folder"}'

# Multipart file upload
curl --location 'https://api.bugsmash.io/api/v2/project/generate-review-link' \
--header 'X-API-Key: YOUR_API_KEY' \
--form 'projectType="pdf"' \
--form 'file=@"/path/to/file.pdf"' \
--form 'projectName="My Review"'

​Getting your API key

​Using your API key

​Authentication errors

​Content-Type header

Getting your API key

Using your API key

Authentication errors

Content-Type header