---
canonical: 'https://htmlcsstoimage.com/features/security'
title: 'API Key Permissions and Security | HTML/CSS to Image'
description: 'Control API key and MCP permissions by action and organization. Configure authenticated proxies and custom storage without resending credentials in image requests.'
---

# Keep credentials out of image requests

Save authenticated proxies and storage destinations at the organization level. HCTI assigns opaque IDs that requests use for proxy routing and image storage without resending the credentials.

## Key capabilities

- Authenticated proxies
- Opaque configuration IDs
- Destination-level storage control

## API key permissions and MCP access controls

API keys have organization-scoped permissions for images, templates, OG configs, proxies, storage destinations, API keys, and usage. Grant access to individual actions: for example, give a renderer `images:create` without granting deletion or storage configuration access. Name and describe keys by application or workflow, and disable keys that are no longer needed.

| Permission | Allows | Does not grant |
| --- | --- | --- |
| `images:create` | Create images and generate signed create-and-render URLs | Image deletion or template changes |
| `templates:read` | List and read templates and their versions | Template creation, updates, or deletion |
| `storage_destinations:create_update` | Create and update storage destinations, including connection settings | Listing or deleting destinations |
| `usage:read` | Read the organization's usage and limits | Changes to organization resources |

Each row describes that permission alone. A key or OAuth token can hold several permissions; granting one action does not implicitly grant the others.

Selected permissions do not automatically include future actions. Organization owners can explicitly enable all current and future permissions. In the public API, this is the separate `all_future_permissions` setting.

MCP uses user-approved OAuth grants, limited by the approving member's organization role. Supported scopes in discovery are not automatic grants. Users review access in the browser and can revoke connected sessions from the dashboard. API key management permissions are excluded from MCP. New grants require another authorization; refreshing a token does not expand access.

See the [API reference](https://htmlcsstoimage.com/api-docs/) for endpoint-specific permissions. Plan requirements and rate limits still apply. Keep API keys and storage secrets out of client-side code and chat prompts.

## Save proxy and storage credentials once

Configure authenticated proxies and storage destinations at the organization level. HCTI assigns each configuration an opaque ID, available in the dashboard or from `list_proxies` and `list_storage_destinations`. Image requests send those IDs as `proxy_id` and `storage_destination_id`, so applications do not resend connection URLs, usernames, passwords, or storage keys.

Proxies and storage destinations are available on plans with 10,000 images per month or more. See [pricing](https://htmlcsstoimage.com/pricing.md) for current plan details.

## Control page access and image retention separately

Route Chromium traffic through a proxy when a page must be reached through an authenticated proxy or a specific source network. Send the rendered image to a [custom storage destination](https://htmlcsstoimage.com/features/custom-storage.md). If **Disable HCTI Storage** is enabled on that destination, HCTI still processes the render and retains its settings and metadata, but does not retain the rendered file, cache it on the HCTI CDN, or provide a public HCTI image URL.

## MCP Integration

Connect an MCP-compatible client to `https://mcp.hcti.io` with OAuth. The tools use the connected organization's HTML/CSS to Image account, permissions, and plan limits.

- The `list_proxies` tool returns the organization's available proxies, if any, with IDs and without sensitive connection details. Use an enabled ID as `proxy_id` when rendering images or templates, including options encoded into signed image URLs.
- The `list_storage_destinations` tool returns the organization's available storage destinations, if any, with IDs and without sensitive connection details. Use an enabled ID as `storage_destination_id` when generating images or PDFs.

[Read the full MCP docs](https://docs.htmlcsstoimage.com/integrations/mcp/).

## Proxy routing and image storage controls

### Pages behind a proxy

Use an authenticated proxy to capture pages that HCTI cannot reach directly from the public internet.

### Known egress path

Route Chromium traffic through a configured proxy when a site requires a specific source network.

### Storage in your account

Write images to your storage destination and, when configured on that destination, prevent HCTI from retaining the rendered file.

### Centralized configuration

Let authorized organization members manage proxy and storage credentials while applications send only the opaque IDs shown in the dashboard.

## Related features

- [Custom Storage](https://htmlcsstoimage.com/features/custom-storage.md): Store generated images in your object storage.
- [Organizations](https://htmlcsstoimage.com/features/organizations.md): Give your team access without per-seat charges.
- [Signed Image URLs](https://htmlcsstoimage.com/features/signed-image-urls.md): Dynamic images without an extra API request.

## Get started

REST API requests require an HTML/CSS to Image account and should be authenticated from trusted application code. Check the API docs and pricing for current setup instructions, limits, and feature availability.

- [View the full feature page](https://htmlcsstoimage.com/features/security)
- [Browse all features](https://htmlcsstoimage.com/features.md)
- [View pricing](https://htmlcsstoimage.com/pricing.md)
- [Read the security docs](https://docs.htmlcsstoimage.com/guides/advanced/)
- [Read the MCP docs](https://docs.htmlcsstoimage.com/integrations/mcp/)