Authentication & keys
Manage workspace API keys, permissions, test mode, and access.
Send Authorization: Bearer YOUR_API_KEY with every authenticated request. Keys are fixed to the workspace where they were created; changing your active workspace in the website does not move your integration.
Secrets appear once when created. Keep them in your server’s secret store. Never include them in browser code, mobile bundles, source control, or a URL. To rotate a key, create a replacement, update your integration, verify requests, let its queued work finish, then revoke the old key. Revocation blocks new requests and operations that have not reached the generation engine. Videos already handed to the engine may finish, even if they are still waiting for a generation slot. Cancel those videos separately if you want to stop them.
| Scope | Allows |
|---|---|
videos:read | List videos, check status, retrieve downloads. |
videos:write | Create, render, resume, and cancel videos. |
assets:read | Read available resources and uploads. |
assets:write | Create and finalize uploads. |
usage:read | Estimate video costs and read workspace API usage and credit information. |
Test and live resources are separated. Test jobs validate your integration, not generation quality, actual processing time, or a final bill. Use a live key only when you intend to spend workspace credits.