Authentication
Learn how to authenticate with the NeedFont API to access your font library programmatically.
Overview
NeedFont uses API keys for authentication. You can create multiple keys with different permissions for different use cases—one for your build scripts, another for your website, etc.
API Keys
Generate keys from your dashboard with specific scopes and permissions.
Scoped Access
Limit keys to read-only, read-write, or specific endpoints for security.
Rate Limits
Each key has configurable rate limits to prevent abuse.
Creating an API Key
- Go to your NeedFont dashboard
- Navigate to Settings → API Keys
- Click “Create New Key”
- Choose a name and scope:
read– List and download fontswrite– Upload, update, and delete fontsserve– Serve fonts via CDN endpoints
- Copy the key immediately—it won't be shown again
Using Your API Key
Include your API key in the Authorization header of every request.
curl -X GET https://needfont.app/api/v1/fonts \
-H "Authorization: Bearer YOUR_API_KEY"GET /api/v1/fonts
Headers:
Authorization: Bearer nf_live_abc123...
Response:
{
"data": [
{
"id": "font_abc123",
"name": "Inter",
"family": "Inter",
"style": "Regular",
"weight": 400,
"format": "otf"
},
...
],
"meta": {
"total": 42,
"page": 1,
"perPage": 20
}
}API Key Scopes
| Scope | Permissions |
|---|---|
| read | List fonts, get font details, download font files |
| write | Upload fonts, update metadata, delete fonts, manage collections |
| serve | Access CDN endpoints, generate CSS, serve WOFF2 files |
| admin | Manage API keys, view usage analytics, configure settings |
Rate Limits
API requests are rate-limited to prevent abuse. Limits are applied per API key.
Standard Limits
- • Read endpoints: 1,000 requests/minute
- • Write endpoints: 100 requests/minute
- • Upload: 50 MB/hour
Rate Limit Headers
- X-RateLimit-Limit: 1000
- X-RateLimit-Remaining: 999
- X-RateLimit-Reset: 1640000000
Exceeded rate limit? Wait for the reset time in X-RateLimit-Reset, or reduce request frequency. The API returns a 429 Too Many Requests status when limits are exceeded.
Error Handling
The API returns consistent error responses with helpful messages.
{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid or expired API key",
"details": {
"keyId": "nf_live_abc..."
}
}
}Security Best Practices
- Use environment variables. Never commit API keys to version control.
- Use minimal scopes. Give each key only the permissions it needs.
- Rotate keys regularly. Create new keys and deprecate old ones periodically.
- Monitor usage. Check your dashboard for unusual activity.