How do I get my Shutterstock API credentials?

You need to create a developer account on the Shutterstock Developer portal and then create a new application. This process will generate your Client ID and Client Secret, which are your API credentials.

What is OAuth 2.0 and why does Shutterstock API use it?

OAuth 2.0 is an authorization framework that allows applications to obtain limited access to user accounts on an HTTP service. Shutterstock uses it to securely grant your application access to its API resources without exposing user passwords, ensuring data privacy and security.

How do I get an access token for the Shutterstock API?

You obtain an access token by making a POST request to Shutterstock's OAuth token endpoint, providing your Client ID and Client Secret. This token is then used in the Authorization header for all subsequent API calls.

Are there SDKs available for the Shutterstock API?

Yes, Shutterstock provides official SDKs for several programming languages, including Python, Java, PHP, Ruby, and Node.js, to simplify API integration.

What should I do if my first API call fails?

Check your Client ID and Client Secret for accuracy, verify the Authorization header format, ensure your access token hasn't expired, and review the API's error message for specific guidance. Network connectivity and correct grant type in the token request are also common points of failure.

Can I use the Shutterstock API for free?

Shutterstock offers free API access for development and testing purposes. Specific usage limits and pricing for live applications are typically based on custom enterprise agreements.

How do I handle rate limits with the Shutterstock API?

The Shutterstock API has rate limits to prevent abuse. You should implement appropriate error handling in your application to detect rate limit errors (often HTTP 429 Too Many Requests) and implement a retry strategy, possibly with exponential backoff.

Shutterstock API Getting Started: Quickstart Guide (2026)

Getting started overview

Integrating with the Shutterstock API involves a sequence of steps designed to ensure secure and authorized access to its media library and services. Developers will typically register for a Shutterstock developer account, generate API credentials, and then use these credentials to authenticate requests to the API. The process culminates in making a successful API call, often to search for images or other media types, which confirms the setup is correct. Shutterstock provides detailed API documentation to guide developers through these steps.

The API supports various media types, including stock photos, vectors, videos, and music, enabling programmatic search, download, and licensing capabilities. Authentication is managed through OAuth 2.0, a standard protocol for access delegation, which helps secure user data without sharing credentials directly.

Here's a quick reference table outlining the initial steps:

Step	What to do	Where
1. Sign Up	Create a Shutterstock developer account.	Shutterstock Developer site
2. Create Application	Register your application to get API keys.	Shutterstock Developer dashboard
3. Understand Authentication	Familiarize yourself with OAuth 2.0 flow.	Shutterstock Authentication Guide
4. Make First Call	Send an authenticated request to a basic endpoint.	Your preferred development environment

Create an account and get keys

To begin using the Shutterstock API, you must first create a developer account. This account serves as your portal to manage applications and generate the necessary credentials for API access.

1. Register for a Shutterstock Developer Account

Navigate to the Shutterstock Developer portal. You will typically find an option to sign up or create an account. Follow the prompts to provide your email address, create a password, and agree to the terms of service. Upon successful registration, you may need to verify your email address to activate your account.

2. Create a New Application

Once logged into your developer account, you will access a dashboard where you can manage your applications. Select the option to 'Create a New Application' or similar. You will be asked to provide some basic information about your application, such as its name and a brief description. This step registers your application with Shutterstock's system.

3. Obtain API Keys (Client ID and Client Secret)

After creating your application, Shutterstock will generate unique credentials for it. These typically include a Client ID and a Client Secret. The Client ID identifies your application, while the Client Secret is a confidential key used to authenticate your application when requesting access tokens. It is crucial to keep your Client Secret secure and never expose it in client-side code or public repositories.

For applications that require user authorization (e.g., to access a user's licensed content), you will also need to configure Redirect URIs. These URIs are the locations to which Shutterstock redirects the user's browser after they have granted or denied permission to your application during the OAuth 2.0 flow. Ensure these URIs are correctly registered in your application settings on the Shutterstock developer dashboard to prevent security vulnerabilities.

Your first request

After obtaining your Client ID and Client Secret, the next step is to make your first authenticated API request. The Shutterstock API uses OAuth 2.0 for authentication. This involves exchanging your Client ID and Client Secret for an access token, which then authorizes your subsequent API calls.

1. Get an Access Token

The most common OAuth 2.0 flow for server-side applications is the Client Credentials Grant. This grant type is suitable for applications that need to access API resources on their own behalf, rather than on behalf of a user. To obtain an access token, you will make a POST request to Shutterstock's token endpoint.

Example using curl for Client Credentials Grant:

curl -X POST \
  'https://api.shutterstock.com/v2/oauth/access_token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET'

Replace YOUR_CLIENT_ID and YOUR_CLIENT_SECRET with your actual credentials. The response will include an access_token and its expires_in duration. This token typically has a limited lifespan, and you will need to refresh it periodically.

2. Make an Authenticated API Call

Once you have an access token, you can use it to make requests to protected API endpoints. You include the access token in the Authorization header of your HTTP requests, typically in the format Bearer YOUR_ACCESS_TOKEN.

A good starting point is to search for images. The Shutterstock Image Search endpoint allows you to query the image library.

Example using curl to search for images:

curl -X GET \
  'https://api.shutterstock.com/v2/images/search?query=nature&per_page=5' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Replace YOUR_ACCESS_TOKEN with the token you obtained in the previous step. This request searches for five images related to 'nature' and should return a JSON object containing an array of image data if successful. The Shutterstock API reference details all available endpoints and parameters.

Common next steps

After successfully making your first API call, you can explore more advanced features and integrate the Shutterstock API deeper into your application. Here are some common next steps:

Explore SDKs

Shutterstock provides official SDKs for several popular programming languages, including Python, Java, PHP, Ruby, and Node.js. Using an SDK can simplify API interaction by handling authentication, request construction, and response parsing, allowing you to focus on your application's logic rather than low-level HTTP details.

Implement User Authorization (OAuth 2.0 Authorization Code Flow)

If your application needs to act on behalf of a Shutterstock user (e.g., to access their licenses or collections), you will need to implement the OAuth 2.0 Authorization Code Grant flow. This involves redirecting users to Shutterstock to authorize your application, receiving an authorization code, and then exchanging that code for an access token and a refresh token. The refresh token allows your application to obtain new access tokens without requiring the user to re-authorize repeatedly.

Integrate Advanced Search and Filters

The Shutterstock API offers extensive search capabilities with various filters to refine results. You can filter by orientation, color, category, license model, and more. Experiment with these parameters to build precise search queries relevant to your application's needs.

Handle Pagination and Rate Limiting

When dealing with large result sets, the API uses pagination to return data in manageable chunks. Understand how to use page and per_page parameters to navigate through results. Additionally, be aware of Shutterstock's rate limits to ensure your application behaves responsibly and avoids being throttled. Implement appropriate error handling and retry mechanisms for rate limit errors.

Explore Licensing and Download Workflows

For applications that require users to license and download content, familiarize yourself with the licensing endpoints. This typically involves checking asset availability, initiating a license, and then downloading the licensed asset. This workflow often requires specific permissions and user authentication.

Troubleshooting the first call

Encountering issues during your initial API setup is common. Here are some troubleshooting tips for your first Shutterstock API call:

Check Credentials: Double-check that your Client ID and Client Secret are correct and have been copied accurately. Even minor typos can lead to authentication failures. Ensure there are no leading or trailing spaces.
Verify Grant Type: Confirm you are using the correct grant_type (e.g., client_credentials) in your token request. Incorrect grant types will result in an error response.
Authorization Header Format: Ensure the Authorization header for your API calls is correctly formatted as Bearer YOUR_ACCESS_TOKEN. A missing 'Bearer' prefix or incorrect spacing will cause authentication to fail.
Expired Access Token: Access tokens have a limited lifespan (indicated by expires_in in the token response). If your token has expired, you will need to request a new one. For long-running applications, implement a token refresh mechanism.
Network Connectivity: Confirm your development environment has outbound network access to api.shutterstock.com. Firewall rules or proxy settings can sometimes block API requests.
Review Error Messages: The Shutterstock API returns descriptive error messages in its JSON responses. Carefully read these messages, as they often pinpoint the exact issue. Common errors include invalid_client, invalid_grant, or unauthorized_client. Consult the Shutterstock API error handling documentation for more details.
Inspect Redirect URIs: If you are using an OAuth flow that involves user authorization, ensure your registered Redirect URIs exactly match the URI used in your authorization request. Mismatches are a frequent cause of 'redirect_uri_mismatch' errors.
Consult Documentation: Re-read the relevant sections of the Shutterstock API documentation, particularly the authentication and getting started guides. Sometimes, a detail is overlooked during the initial setup.
Use a REST Client: Tools like Postman or Insomnia can help isolate issues by allowing you to construct and test API requests independently of your code. This can help determine if the problem lies with your code or the API setup itself.