Projects & access
How projects, the allowlist, and keyless transform URLs fit together.
A project is Keenpix's core primitive: it's one origin, one allowlist, and one analytics view. A single Keenpix instance can host many projects (one per site, brand, or environment).
Keyless transforms by design
The transform endpoint needs no API key. Access is gated entirely by each project's domain allowlist — Keenpix will only fetch an image whose source host is on the list. This means:
- You can put the transform URL directly in public HTML; there's no secret to leak.
- An empty allowlist blocks every request (fail-closed).
- Private/internal addresses are always refused (see Security).
For trusted backend systems that manage projects programmatically, Keenpix also offers internal API keys over the JSON API. Those are separate from the public transform endpoint, which stays keyless. See the SDK API reference for project management, allowed-host updates, configuration discovery, and cache prewarming.
Anatomy of a request
https://keenpix.example.com/img/https://cdn.example.com/hero.jpg
?project=PROJECT_ID ← which project (its allowlist gates access)
&w=1200&fmt=auto ← transformsScoping the dashboard
The dashboard works at two levels: All projects (org-wide analytics and logs) or a single project picked from the switcher at the top of the sidebar. Settings are always per-project.