Bunny.net Authentication: API Keys & Security Best Practices (2026)

Authentication overview

Bunny.net provides various services, including BunnyCDN for content delivery, Bunny Stream for video, and Bunny Storage for file hosting. Access to these services, whether through the web control panel or programmatically via the API, requires authentication to verify user identity and authorize actions. The primary method for programmatic access to the Bunny.net API is through API Keys. These keys function as bearer tokens, which must be included in the headers of API requests to authenticate and authorize the caller Bunny.net API documentation.

Authentication ensures that only authorized users and applications can manage resources, modify configurations, and retrieve sensitive data within their Bunny.net account. This page outlines the specific authentication methods supported by Bunny.net, details how to obtain the necessary credentials, provides an example of an authenticated request, and discusses security best practices for handling API keys.

Supported authentication methods

Bunny.net primarily relies on API keys for authentication when interacting with its API. These keys are unique alphanumeric strings generated within the Bunny.net control panel and can be configured with varying levels of access permissions.

API Key (Bearer Token)

This is the standard authentication method for all programmatic interactions with the Bunny.net API. An API Key is a secret token that grants access to your Bunny.net account and its associated services. When making an API request, this key is passed in the AccessKey HTTP header, identifying the caller and authorizing the requested operation. The security of this method depends heavily on the confidentiality of the API key, as anyone possessing the key can perform actions on behalf of the account or the specific permissions granted to that key Bunny.net API authentication details.

Table of Authentication Methods

Bunny.net's API keys offer flexibility in permissioning. A Master API Key provides full access to all account resources and settings. For more granular control, you can generate API keys with specific permissions, such as read-only access to certain storage zones or management capabilities for a particular CDN pull zone. This approach adheres to the principle of least privilege, minimizing the impact of a compromised key Wikipedia on the Principle of Least Privilege.

Getting your credentials

To interact with the Bunny.net API, you need an API Access Key. These keys are generated and managed within the Bunny.net control panel.

Steps to obtain an API Access Key:

1. Log in to the Bunny.net Control Panel: Navigate to the Bunny.net homepage and log in with your account credentials.
2. Navigate to API Settings: Once logged in, locate the 'API' or 'Account Settings' section. Typically, this is found under your profile or account management menu.
3. Generate a New API Key:
   • Master API Key: The main API key for your account is usually displayed directly in the API settings. This key grants full access to all services and is equivalent to your account password for API access. Exercise extreme caution when using and storing this key.
   • Scoped API Keys (if available): For more restricted access, look for options to create additional API keys with specific permissions. For instance, you might generate a key that only allows read access to a particular storage zone or management of a specific pull zone. This is highly recommended for applications that do not require full account permissions Bunny.net API key generation guide.
4. Copy the API Key: Once generated, the API key will be displayed. Copy it immediately and store it securely. For security reasons, API keys are often only shown once upon creation and cannot be retrieved again from the control panel. If lost, you will need to generate a new key and revoke the old one.

It is crucial to treat API keys as sensitive as passwords. Never hardcode them directly into your application's source code, commit them to version control systems, or expose them in client-side code. Instead, use environment variables or a secure secret management solution.

Authenticated request example

This example demonstrates how to make an authenticated request to the Bunny.net API using an API key (AccessKey) in the HTTP header. The example uses curl for simplicity, but the same principle applies to any HTTP client or Bunny.net SDK.

Let's assume you want to list your CDN Pull Zones. The Bunny.net API endpoint for this might be https://api.bunny.net/pullzone.

Example using curl (Bash)

Replace YOUR_BUNNY_NET_API_ACCESS_KEY with your actual API key.

curl -X GET \
  "https://api.bunny.net/pullzone" \
  -H "Accept: application/json" \
  -H "AccessKey: YOUR_BUNNY_NET_API_ACCESS_KEY"

Explanation of the example:

• curl -X GET: Specifies an HTTP GET request.
• "https://api.bunny.net/pullzone": The target API endpoint for listing pull zones.
• -H "Accept: application/json": Indicates that the client prefers a JSON response.
• -H "AccessKey: YOUR_BUNNY_NET_API_ACCESS_KEY": This is the critical authentication header. The AccessKey header contains your Bunny.net API key, which authenticates your request.

Example using Node.js (with axios)

This example demonstrates how to make a similar authenticated request using Node.js with the popular axios library.

const axios = require('axios');

const API_ACCESS_KEY = process.env.BUNNY_NET_API_KEY; // Stored as environment variable
const BASE_URL = 'https://api.bunny.net';

async function listPullZones() {
  try {
    const response = await axios.get(`${BASE_URL}/pullzone`, {
      headers: {
        'Accept': 'application/json',
        'AccessKey': API_ACCESS_KEY
      }
    });
    console.log('Pull Zones:', response.data);
  } catch (error) {
    console.error('Error listing pull zones:', error.response ? error.response.data : error.message);
  }
}

listPullZones();

Explanation:

• API_ACCESS_KEY = process.env.BUNNY_NET_API_KEY;: The API key is retrieved from an environment variable, a recommended security practice.
• headers: { 'AccessKey': API_ACCESS_KEY }: The API key is passed in the AccessKey HTTP header, just like in the curl example.

Bunny.net also offers SDKs in several languages, including PHP, Node.js, Python, Go, Ruby, and C# Bunny.net SDK availability. These SDKs abstract away the HTTP request details, providing a more convenient way to interact with the API while still requiring you to provide your API key securely.

Security best practices

Securing your Bunny.net API keys is paramount to protect your account and data. Adhering to these best practices reduces the risk of unauthorized access and potential service disruption.

1. Keep API Keys Confidential:
   • Never hardcode keys: Avoid embedding API keys directly into your application's source code.
   • Use environment variables: Store API keys in environment variables on your server or development machine. This keeps them out of your codebase and version control.
   • Secure secret management: For production environments, utilize secret management services (e.g., AWS Secrets Manager, Azure Key Vault, Google Secret Manager) to store and retrieve keys securely at runtime Google Cloud Secret Manager documentation.
   • Avoid client-side exposure: Never expose API keys in client-side code (e.g., JavaScript in a web browser), as they can be easily extracted by malicious users.
2. Principle of Least Privilege:
   • Generate API keys with the minimum necessary permissions required for the task. If an application only needs to read CDN statistics, provide it with a read-only key, not a Master API Key.
   • Bunny.net allows for granular control over API key permissions, which should be leveraged to limit the scope of potential damage if a key is compromised.
3. Regular Key Rotation:
   • Periodically rotate your API keys (e.g., every 90 days). This limits the window of exposure for a compromised key.
   • When rotating, generate a new key, update all applications to use the new key, and then revoke the old key.
4. Monitor API Key Usage:
   • Regularly review API access logs and audit trails provided by Bunny.net to detect any unusual or unauthorized activity associated with your API keys.
   • Set up alerts for suspicious API usage patterns.
5. Secure Communication (HTTPS/TLS):
   • Always ensure all API requests are made over HTTPS (TLS encrypted connections). This protects your API key and other sensitive data from interception during transit. Bunny.net's API enforces HTTPS.
6. IP Whitelisting (if available):
   • If Bunny.net allows, restrict API key usage to a specific set of trusted IP addresses. This adds an extra layer of security, ensuring that even if a key is stolen, it cannot be used from an unauthorized location.
7. Revoke Compromised Keys Immediately:
   • If you suspect an API key has been compromised, revoke it immediately through the Bunny.net control panel and generate a new one.

By implementing these practices, developers can significantly enhance the security posture of their applications and protect their Bunny.net resources from unauthorized access.