Account access
Anyone can read the documentation, Markdown articles and OpenAPI specification without signing in or providing an API key. Sign in to create and manage your own scoped API keys in API & MCP settings. API and MCP calls authenticate the key owner without a browser session. Every key uses its owner's credit balance, assets and download entitlements; it does not grant access to another account. Keep your keys private instead of sharing an administrator key with other users.
Bearer authentication
Send Authorization: Bearer <key> in the HTTP header. The key never belongs in a query string. Create and delete keys in API & MCP settings. The plaintext key is shown once; store it in a secret manager or client environment.
New keys never expire by default. You can instead choose 7, 30, 90 or 365 days when creating a key. Existing keys keep their original expiration date. At most 30 keys can be active at once, including keys without an expiration date. Deleting an active key or letting it expire frees a slot. Only key hashes are persisted. Deletion permanently removes the key record and immediately blocks further authentication with it. Active, expired and previously revoked keys can all be deleted. Existing generation tasks and their webhooks continue after deletion.
Scopes
| Scope | Allows |
|---|---|
tasks:write | Submit generation tasks |
tasks:read | Read task status, capabilities, owned assets and save destinations |
credits:read | Read balance and estimate costs |
uploads:write | Reserve and confirm an upload |
downloads:read | Authorize a temporary asset download |
A key's scope never grants access to another user's assets or tasks. Invalid, expired, deleted or previously revoked keys and keys belonging to a currently suspended account return 401; missing scopes return 403. See Errors.
Transport
REST uses JSON over HTTPS. MCP uses stateless HTTP JSON at /api/mcp; GET and DELETE are not supported. No OAuth or SSE is required in this release. Client configurations use environment placeholders rather than embedding plaintext credentials in a shared file.