Account access
Anyone can read the documentation, Markdown articles and OpenAPI specification without signing in or providing an API key. Sign in to create and manage your own scoped API keys in API & MCP settings. API and MCP calls authenticate the key owner without a browser session. Every key uses its owner's credit balance, assets and download entitlements; it does not grant access to another account. Keep your keys private instead of sharing an administrator key with other users.
Bearer authentication
Send Authorization: Bearer <key> in the HTTP header. The key never belongs in a query string. Create and revoke keys in API & MCP settings. The plaintext key is shown once; store it in a secret manager or client environment.
Keys expire after 90 days. At most 30 unrevoked, unexpired keys can be active at once. Revocation or expiration frees a slot. Only key hashes are persisted.
Scopes
| Scope | Allows |
|---|---|
tasks:write | Submit generation tasks |
tasks:read | Read task status, capabilities, owned assets and save destinations |
credits:read | Read balance and estimate costs |
uploads:write | Reserve and confirm an upload |
downloads:read | Authorize a temporary asset download |
A key's scope never grants access to another user's assets or tasks. Invalid, expired or revoked keys and keys belonging to a currently suspended account return 401; missing scopes return 403. See Errors.
Transport
REST uses JSON over HTTPS. MCP uses stateless HTTP JSON at /api/mcp; GET and DELETE are not supported. No OAuth or SSE is required in this release. Client configurations use environment placeholders rather than embedding plaintext credentials in a shared file.