API Authentication

Getting your API key

API keys are generated from your VideoNest account settings.

1. Go to Settings > API in your VideoNest dashboard.
2. Click Generate New API Key.
3. Give the key a descriptive name (e.g., "Production App" or "Zapier Integration") so you can identify it later.
4. Copy the key immediately — it will not be shown again after you leave the page.

Making authenticated requests

Include your API key as a Bearer token in the Authorization header of every request:

Authorization: Bearer YOUR_API_KEY

Here is a complete example using curl to list your videos:

curl -X GET https://api.videonest.co/v1/videos \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Replace YOUR_API_KEY with the key you copied from Settings > API. All API requests must be made over HTTPS — requests over plain HTTP will be rejected.

API base URL

All VideoNest API endpoints are relative to the following base URL:

https://api.videonest.co/v1

Rate limits

API requests are rate limited per API key. The default limit is 1,000 requests per hour. This limit is shared across all endpoints for a given key.

When you exceed the limit, the API returns a 429 Too Many Requests response. The response includes a Retry-After header indicating how many seconds to wait before making the next request:

HTTP/1.1 429 Too Many Requests
Retry-After: 120

Build your integration to respect the Retry-After value and back off accordingly. If your application consistently requires higher limits, contact support to discuss an increased rate limit for your account. For a full list of endpoints and their individual behaviors, see the API Endpoints reference.

Response format

All API responses are JSON. Successful responses include a data field containing the requested resource or collection. Error responses include an error object with a machine-readable code and a human-readable message.

Example success response:

{
  "data": {
    "id": "vid_abc123",
    "title": "My Video",
    "status": "ready"
  }
}

Example error response:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key."
  }
}

Common error codes you may encounter:

• unauthorized — the API key is missing, invalid, or has been revoked (HTTP 401)
• forbidden — the key does not have permission for the requested action (HTTP 403)
• not_found — the requested resource does not exist (HTTP 404)
• rate_limited — you have exceeded the request rate limit (HTTP 429)
• server_error — an unexpected error occurred on the server (HTTP 500)

Security best practices

Following these practices reduces the risk of your API key being exposed or misused:

• Use environment variables. Store your API key in an environment variable (e.g., VIDEONEST_API_KEY) and read it in your application at runtime. Never hardcode it in source files.
• Rotate keys periodically. Generate a new key from Settings > API on a regular schedule, update your application's configuration, then revoke the old key. This limits the window of exposure if a key is leaked.
• Create purpose-specific keys. Use a separate API key for each integration or environment (development, staging, production). That way, revoking one key does not affect all your integrations at once.
• Verify webhook payloads. If you use webhooks, always validate the payload signature before processing it. See the Webhooks guide for details on signature verification.
• Audit your keys regularly. Review the list of active keys at Settings > API and revoke any that are no longer in use.