Authentication

Every request carries an API key that belongs to one organization. There is no account switching and no workspace parameter — the tenant comes from the credential, so a key can only ever see and spend its own organization’s data and credits.

curl https://api.creatorline.io/v1/me \
  -H "Authorization: Bearer $CREATORLINE_API_KEY"

X-API-Key: crl_sk_live_… works identically if your tooling prefers it.

Creating a key

Owners and admins create keys in the studio under Settings → API.

The key is displayed exactly once, when you create it. We store only a keyed hash of it, so there is no endpoint — and no support request — that can show it to you again. Lost a key? Revoke it and create another.

Anatomy

crl_sk_live_a7F3k2p9QxZm_8Kd2mXpLq…4f2c_9xQ2mR
└ prefix ──┘└ key id ────┘└ secret ────┘└ crc ┘

crl_sk_live_

Marks the string as a Creatorline secret key so secret scanners and log scrubbers can spot a leak. If one of these ever lands in a public repository, revoke it immediately.

12 chars

Public. It is what identifies the key in the dashboard (crl_sk_live_a7F3k2p9QxZm…4f2c) and in our logs — safe to quote in a support conversation.

32 chars

190 bits of randomness, never stored. We keep only a keyed hash.

6 chars

A checksum over everything before it. A mistyped or forged key is rejected instantly, without a database lookup.

Scopes

read

Every GET, plus cost estimates. Cannot spend a single credit. Use this for CI and for anything that only reads.

write

Everything above, plus starting generations, uploading media, and publishing posts.

A read key that attempts a write gets a 403 naming the problem, not a mysterious failure:

{
  "error": {
    "type": "permission_error",
    "code": "insufficient_scope",
    "message": "This API key is read-only. Create a key with the `write` scope to run generations."
  },
  "request_id": "req_8fQ2mRxK1pLd"
}

Rotation and revocation

Revoking is immediate — the next request with that key gets a 401. The key’s row survives so your usage history and audit trail keep resolving. To rotate without downtime: create the new key, deploy it, then revoke the old one. A key can also be given an expiry at creation, which is the right choice for a short-lived job.

Rate limits

120 requests per minute per key. Every response carries the state of your window:

Header
`x-ratelimit-limit`	requests allowed per window
`x-ratelimit-remaining`	requests left
`x-ratelimit-reset`	unix seconds when it resets

On a 429, honour Retry-After. Generation is separately gated by your credit balance, which is usually the limit you will meet first.

Keeping keys safe

Server-side only

A key can spend your organization’s credits and publish to your creators’ accounts. Never ship one to a browser, a mobile app, or anything a user can read.

Environment, not source

CREATORLINE_API_KEY in your environment or secret manager. Never in a repository, never in a URL query string.

One key per consumer

A key per service, per environment, per developer machine. Then revoking one is a non-event instead of an outage, and the usage counters tell you who is spending what.

Get started

Guides

API reference

Creating a key

Anatomy

Scopes

read

write

Rotation and revocation

Rate limits

Keeping keys safe

​Creating a key

​Anatomy

​Scopes

read

write

​Rotation and revocation

​Rate limits

​Keeping keys safe

Creating a key

Anatomy

Scopes

Rotation and revocation

Rate limits

Keeping keys safe