Duply Authentication: API Key Security and Best Practices (2026)

Authentication overview

Duply provides a REST API for programmatic access to its AI image generation and editing capabilities. To ensure that only authorized applications and users can interact with its services, Duply employs an API key-based authentication system. This model is common for cloud-based APIs, offering a straightforward yet effective way to manage access control.

An API key serves as a unique identifier and a secret token that an application provides when making requests to the Duply API. The key verifies the identity of the requesting application or user and grants access to the associated account's resources and API usage quota. This method allows Duply to track API calls, enforce rate limits, and apply usage-based billing, aligning with its usage-based pricing model.

The core principle behind API key authentication is that the key itself functions as a secret. Any entity possessing the key can make requests on behalf of the associated account. Therefore, securing API keys is a critical operational consideration for any developer integrating with Duply or similar services. Proper handling prevents unauthorized access, potential misuse of services, and unexpected charges.

While API keys are effective for identifying clients, they differ from more advanced authorization protocols like OAuth, which focus on delegated authorization without sharing user credentials. For Duply's use case of server-to-server or application-to-server communication for image processing, API keys provide a suitable balance of security and operational simplicity.

Supported authentication methods

Duply primarily supports API key authentication. This method involves generating a unique secret key from your Duply account dashboard and including it in every API request. The key is typically passed in an HTTP header, which is a standard and recommended practice for transmitting sensitive information in API calls.

The table below summarizes the characteristics of API key authentication as implemented by Duply:

API Key Authentication Details

• Mechanism: The API key is a long, randomly generated string of characters that acts as both an identifier and a secret.
• Transmission: For Duply, the API key is expected to be sent in the Authorization HTTP header. This is a standard practice that helps separate authentication credentials from the request body or URL parameters, reducing exposure.
• Scope: Each API key typically provides full access to the resources available to the generating account, subject to any role-based access controls that Duply might implement at the account level. It's crucial not to expose API keys in client-side code (e.g., JavaScript in a web browser) where they could be easily intercepted.
• Revocation: Duply allows users to revoke existing API keys and generate new ones through their account dashboard. This feature is vital for security incidents or when a key might have been compromised.

Getting your credentials

To obtain your Duply API key, you will typically follow a process within the Duply web application or developer dashboard. This process is designed to be straightforward, allowing developers to quickly integrate with the API.

Steps to retrieve your Duply API Key:

1. Sign Up/Log In: Navigate to the Duply website and either create a new account or log in to an existing one. Duply offers a free tier with 50 API credits per month, allowing new users to obtain an API key and begin testing their integrations without immediate financial commitment.
2. Access Developer Dashboard: Once logged in, locate the developer section or API settings within your account dashboard. This is commonly found under sections like "API Keys," "Settings," or "Developer Tools."
3. Generate API Key: Within the API settings, there should be an option to generate a new API key. Duply may allow you to name your keys for easier management, especially if you plan to use multiple keys for different applications or environments (e.g., development, staging, production).
4. Copy and Secure Your Key: After generation, the API key will be displayed. This is usually the only time the full key is shown. Copy it immediately and store it securely. Treat your Duply API key with the same level of confidentiality as you would a password. Do not hardcode it directly into source code that will be committed to public repositories, and avoid sharing it unnecessarily.
5. Review Documentation: For specific instructions and any nuances related to key generation or management, always refer to the official Duply documentation.

It is recommended to generate separate API keys for different applications or environments. This practice enhances security by limiting the blast radius if one key is compromised and simplifies key rotation and revocation without affecting other services.

Authenticated request example

Once you have obtained your Duply API key, you can integrate it into your API requests. The key is typically sent in the Authorization header using a Bearer token scheme. This is a widely adopted standard for token-based authentication in RESTful APIs, as detailed in RFC 6750 for Bearer Token Usage.

Here's an example of how to make an authenticated request to a hypothetical Duply API endpoint using curl, a common command-line tool for making HTTP requests:

curl -X POST \

  https://api.duply.co/v1/image/generate \

  -H "Authorization: Bearer YOUR_DUPLY_API_KEY" \

  -H "Content-Type: application/json" \

  -d '{

    "prompt": "a product shot of a sleek, modern smartphone on a minimalist white background",

    "width": 1024,

    "height": 1024,

    "output_format": "png"

  }'

In this example:

• -X POST specifies the HTTP method (POST, often used for creating resources or performing actions).
• https://api.duply.co/v1/image/generate is the hypothetical API endpoint for generating an image.
• -H "Authorization: Bearer YOUR_DUPLY_API_KEY" is the critical authentication header. Replace YOUR_DUPLY_API_KEY with the actual API key you retrieved from your Duply dashboard. The Bearer prefix is standard for this type of token.
• -H "Content-Type: application/json" specifies that the request body is in JSON format.
• -d '{...}' contains the JSON payload, which includes parameters for the image generation request, such as the prompt, dimensions, and output format.

Developers using Duply's API will find code examples in various popular programming languages, including Node.js, Python, PHP, Ruby, and Go, in the official documentation, demonstrating how to construct authenticated requests in each specific language environment.

Security best practices

The security of your Duply integration largely depends on how carefully you manage your API keys. Adhering to security best practices is essential to prevent unauthorized access and potential misuse of your account.

API Key Management Guidelines:

1. Treat API Keys as Secrets: Your Duply API key is a credential that grants access to your account. Treat it with the same level of security as you would a password or private cryptographic key.
2. Avoid Hardcoding in Source Code: Never embed your API keys directly into your application's source code, especially if that code might be publicly accessible (e.g., in a client-side application or a public Git repository).
3. Use Environment Variables or Configuration Files: For server-side applications, store API keys in environment variables (e.g., DUPLY_API_KEY=YOUR_KEY) or secure configuration management systems. This keeps the key separate from your codebase and allows for easier rotation and environment-specific keys.
4. Implement Least Privilege: If Duply offers granular permissions for API keys (e.g., read-only vs. full access), generate keys with only the necessary permissions required for a specific task or application. This limits the damage if a key is compromised.
5. Regular Key Rotation: Periodically rotate your API keys. This means generating a new key, updating your applications to use the new key, and then revoking the old one. Regular rotation reduces the window of opportunity for a compromised key to be exploited.
6. Secure Storage: Ensure that any systems storing API keys (e.g., configuration servers, deployment pipelines) are themselves secured against unauthorized access.
7. Monitor API Usage: Regularly review your Duply API usage logs for any unusual activity. Sudden spikes in requests or requests from unexpected geographical locations could indicate a compromised key.
8. Restrict IP Addresses (where available): If Duply's dashboard allows, consider restricting API key usage to a whitelist of specific IP addresses. This adds an extra layer of security, ensuring that even if a key is stolen, it can only be used from authorized networks.
9. HTTPS Only: Always ensure that all API calls to Duply are made over HTTPS. This encrypts the communication channel, protecting your API key and other request data from interception during transit. Duply's API endpoints are designed to be accessed via HTTPS.
10. Client-Side Security: If your application requires client-side interaction (e.g., a web application) that might indirectly trigger Duply API calls, ensure those calls are routed through your secure backend. Exposing API keys directly in client-side code is a significant security risk.

By diligently following these best practices, developers can significantly enhance the security posture of their Duply integrations and protect their accounts from potential vulnerabilities.