CheetahO Authentication: Methods and Security (2026)

Authentication overview

CheetahO provides a REST API for programmatic image optimization, which requires authentication for all requests. The platform utilizes API keys as its primary method for verifying the identity of API consumers and authorizing their access to services. An API key is a unique string that clients generate and manage through their CheetahO account dashboard. When making requests to the CheetahO API, this key must be included to establish the sender's identity and ensure that the request originates from an authorized user.

This authentication model is common for cloud-based services, offering a balance of security and ease of use for developers integrating image compression into their applications, websites, or content management systems. The API key acts as a secret token, enabling the CheetahO system to link API calls to a specific user account and enforce usage limits, track consumption, and manage billing according to the user's subscription plan. Proper handling and protection of API keys are critical to maintaining the security of an integration.

Supported authentication methods

CheetahO exclusively supports API key authentication for its REST API. This method involves generating a unique string from the user dashboard and transmitting it with each API request. The API key serves as both an identifier and a secret token, authenticating the user and granting access to the subscribed services.

While other authentication schemes exist, such as OAuth 2.0 (often used for delegated authorization, as described by the OAuth 2.0 specification) or token-based authentication (like JSON Web Tokens, or JWTs), CheetahO's focus on a direct, server-side API for image processing makes API keys a suitable and straightforward solution. For integrations that include WordPress, Magento, or OpenCart, the respective plugins and extensions handle the API key configuration internally after an initial setup, abstracting the direct API interaction from the end-user.

Getting your credentials

To use the CheetahO API, you need to obtain an API key. This key is your credential for authenticating all requests. The process typically involves these steps:

1. Create a CheetahO Account: If you don't already have one, register for an account on the CheetahO website. A free tier offering 100 free optimizations is available, which is sufficient for initial testing and integration setup.
2. Access the Dashboard: Log in to your CheetahO account. Upon successful login, you will typically be directed to your user dashboard.
3. Locate API Key Section: Within the dashboard, navigate to a section related to 'API Settings', 'Developers', or 'Account Settings'. The exact label may vary, but it will be where you manage API access. Consult the CheetahO documentation for precise navigation instructions.
4. Generate/Retrieve API Key: In this section, you will find your pre-generated API key, or an option to generate a new one. Some platforms allow users to regenerate keys for security purposes, invalidating previous keys. Always copy the full API key.
5. Store Securely: Once you have your API key, it is crucial to store it securely. Treat it like a password. Avoid hardcoding it directly into client-side code, and prevent accidental exposure in public repositories or logs.

For integrations with CMS platforms like WordPress, Magento, or OpenCart, the respective CheetahO plugins will have specific fields in their settings where you can paste this API key. The plugin then handles the secure transmission of the key to the CheetahO API on your behalf.

Authenticated request example

Authenticating with the CheetahO API typically involves sending your API key in the request headers. The exact header name and format will be specified in the official CheetahO API documentation. Below is a conceptual example using curl, assuming the API key is sent via an X-CheetahO-API-Key header to an image optimization endpoint. Always refer to the CheetahO developer documentation for the definitive API endpoint and header structure.

curl -X POST \
  'https://api.cheetaho.com/v1/optimize' \
  -H 'Content-Type: application/json' \
  -H 'X-CheetahO-API-Key: YOUR_API_KEY_HERE' \
  -d '{
    "url": "https://example.com/original-image.jpg",
    "quality": 80,
    "format": "webp"
  }'

In this example:

• YOUR_API_KEY_HERE should be replaced with the actual API key obtained from your CheetahO dashboard.
• The -H 'X-CheetahO-API-Key: YOUR_API_KEY_HERE' line demonstrates how the API key is included in the request headers.
• The -d flag is used to send the request body, which specifies the URL of the image to optimize, the desired quality, and the output format.

Client libraries or SDKs, if available or built by the developer, would abstract this HTTP request detail, allowing developers to call functions like cheetaho.optimize_image(url, quality, format) after initializing the client with the API key.

Security best practices

Securing your API keys is essential to prevent unauthorized access to your CheetahO account and services, managing your usage and billing. Adherence to general API security principles is advisable, as outlined by resources such as the Mozilla Developer Network's guide on Authorization headers.

• Treat API Keys as Secrets: Your API key grants full access to your CheetahO account's optimization capabilities. Treat it with the same level of confidentiality as a password or private key.
• Avoid Hardcoding in Client-Side Code: Never embed your API key directly into client-side code (e.g., JavaScript in a web browser, mobile app bundles). This exposes the key to end-users, who could then extract and misuse it.
• Use Environment Variables: For server-side applications, store API keys in environment variables rather than directly in your codebase. This prevents keys from being committed to version control systems (like Git) and makes it easier to manage keys across different deployment environments (development, staging, production).
• Use a Secret Management Service: For more complex deployments or enterprise-level security, consider using dedicated secret management services (e.g., AWS Secrets Manager, Google Cloud Secret Manager, Azure Key Vault). These services provide secure storage and retrieval of sensitive credentials.
• Restrict Key Permissions (if applicable): While CheetahO's API keys might have broad permissions, if a service offers granular access control, always configure keys with the minimum necessary permissions for their intended task (principle of least privilege).
• Regularly Rotate Keys: Periodically generate new API keys and replace the old ones in your applications. This reduces the window of opportunity for a compromised key to be exploited. If you suspect a key has been compromised, revoke it immediately through your CheetahO dashboard and generate a new one.
• Secure Communication Channels: Always ensure that API requests are made over HTTPS (HTTP Secure). This encrypts the data in transit, protecting your API key and request payloads from eavesdropping. CheetahO's API endpoints are expected to enforce HTTPS.
• Monitor API Usage: Regularly check your CheetahO account's usage statistics for any anomalies that might indicate unauthorized access or misuse of your API key.