Important API Update - Security related changes

flyingdutchie

My SmugFig API has been made compliant with the new security features.
http://blog.antonspaans.com/smugfig-api/

devbobo

API Keys are now being issued

pgrove

Thanks for Keys - Need help using.

devbobo wrote:

API Keys are now being issued

Thanks for getting the API Key Distribution back into service.

I now have three keys, but they don't work. Status in Control Pannel>Settings is reported as "Open."

Using:

http://api.smugmug.com/services/api/rest/1.2.1/?method=smugmug.login.anonymously&APIkey=

or

http://api.smugmug.com/hack/rest/1.2.0/?method=smugmug.login.anonymously&APIkey=

Calls with any of the three keys pasted at the end returns:

<?xml version="1.0" encoding="utf-8" ?>
<rsp stat="fail">
<err code="18" msg="invalid API key" />
</rsp>

Any hints?

devbobo

pgrove wrote:

Thanks for getting the API Key Distribution back into service.

I now have three keys, but they don't work. Status in Control Pannel>Settings is reported as "Open."

Using:

http://api.smugmug.com/services/api/rest/1.2.1/?method=smugmug.login.anonymously&APIkey=

or

http://api.smugmug.com/hack/rest/1.2.0/?method=smugmug.login.anonymously&APIkey=

Calls with any of the three keys pasted at the end returns:

<?xml version="1.0" encoding="utf-8" ?>
<rsp stat="fail">
<err code="18" msg="invalid API key" />
</rsp>

Any hints?

The K in APIKey should be upper case <img src="https://us.v-cdn.net/6029383/emoji/thumb.gif&quot; border="0" alt="" >

rainforest1155

Could we have this page updated to remove the notice about API keys not being issued?

Thanks,
Sebastian

B-root

Hi David.

What about the upload of images via HTTP PUT ? Are the AlbumKey / ImageKey also needed ? If yes what are the names of the headers ? X-Smug-AlbumKey and X-Smug-ImageKey ?

Thanks in advance.

devbobo

B-root wrote:

Hi David.

What about the upload of images via HTTP PUT ? Are the AlbumKey / ImageKey also needed ? If yes what are the names of the headers ? X-Smug-AlbumKey and X-Smug-ImageKey ?

Thanks in advance.

ImageKey/AlbumKey are only required for methods where a person can make a call in the context of an anonymous user (or non-owner), eg smugmug.images.get.

For methods that can only be carried out by the woner like uploading or creating/editing albums, no key is required.

Cheers,

David

blackgold9

Hate to resurrect the old thread, but i'm trying to implement a smugmug community browser and need to understand albumkeys. The links referened in the early posts no longer exist. What exactly are image/album keys? Do they change?

pgrove

blackgold9 wrote: »

Hate to resurrect the old thread, but i'm trying to implement a smugmug community browser and need to understand albumkeys. The links referened in the early posts no longer exist. What exactly are image/album keys? Do they change?

This thread covers API keys which are different than your question.

Image/album keys are codes added to the end of image/album IDs to mace it difficult to find hidden images and albums since they can be guessed fairly easily. If you look at the URL for an album you will see nnnnn_kkkk for both the album and image where nnnnn is the ID and kkkk is the key.

Not an exact answer, but perhaps it is enough to help.