# API Requests

[View original](https://ittybit.com/api/requests)

<Callout>
  <Icon icon="info" />

  Don't want to make HTTP requests?

  We provide [SDKs](/sdks) for typescript, python, ruby, go, and php.
</Callout>

***

## Request Bodies

`POST`, `PUT`, and `PATCH` endpoints accept JSON-encoded request bodies.

<Tabs items={["request.js", "request.sh"]}>
  <Tab value="request.js">
    ```js
    const response = await fetch(`https://api.ittybit.com/files`, {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        url: "https://ittyb.it/sample.mp4",
      }),
    });
    ```
  </Tab>

  <Tab value="request.sh">
    ```shell
    curl -X POST https://api.ittybit.com/files \
    -H "Content-Type: application/json" \
    -d '{"url": "https://ittyb.it/sample.mp4"}'
    ```
  </Tab>
</Tabs>

To avoid issues with double-encoding, we recommend setting the `Content-Type` header to `application/json` in your requests.

***

## Security

The Ittybit API uses [API Keys](/docs/keys) to authenticate requests.

You should pass your API Key in the `Authorization` header of your requests. The value should be prefixed with `Bearer` followed by a space and then your key e.g. `Bearer sk_test_abcdefg...`.

<Tabs items={["request.js", "request.sh"]}>
  <Tab value="request.js">
    ```js
    const response = await fetch(`https://api.ittybit.com/files`, {
      headers: {
        Authorization: `Bearer ${ITTYBIT_API_KEY}`,
      },
    });
    ```
  </Tab>

  <Tab value="request.sh">
    ```shell
    curl "https://api.ittybit.com/files" \
    -H "Authorization: Bearer ITTYBIT_API_KEY"
    ```
  </Tab>
</Tabs>

API requests without authentication, or with an invalid API Key, will fail.

<Callout>
  <Icon icon="warning" />

  Your API Keys give privileged access to your project resources so they should be kept secret. Be careful not to share them in publicly accessible areas such as GitHub, client-side code, etc.

  You can view and manage your keys in the [Ittybit Webapp](/login).
</Callout>

***

## Environments

It is recommended to setup separate projects (within a single org) for each of your development and production environments, and to create different [API Keys](/docs/keys) for each environment.

This will allow you to separate your test and production media.

***

## HTTPS

API requests must be made over HTTPS.

Calls made over plain HTTP will fail.

***

## Character Encoding

To avoid issues with character encoding, please ensure that your requests are made with `UTF-8` encoding.