Skip to main content
Every request carries an API key that belongs to one organization. There is no account switching and no workspace parameter — the tenant comes from the credential, so a key can only ever see and spend its own organization’s data and credits.
X-API-Key: crl_sk_live_… works identically if your tooling prefers it.

​
Creating a key

Owners and admins create keys in the studio under Settings → API.
The key is displayed exactly once, when you create it. We store only a keyed hash of it, so there is no endpoint — and no support request — that can show it to you again. Lost a key? Revoke it and create another.

​
Scopes

read

Every GET, plus cost estimates. Cannot spend a single credit. Use this for CI and for anything that only reads.

write

Everything above, plus starting generations, uploading media, and publishing posts.
A read key that attempts a write gets a 403 naming the problem, not a mysterious failure:

​
Rotation and revocation

Revoking is immediate — the next request with that key gets a 401. The key’s row survives so your usage history and audit trail keep resolving. To rotate without downtime: create the new key, deploy it, then revoke the old one. A key can also be given an expiry at creation, which is the right choice for a short-lived job.

​
Rate limits

120 requests per minute per key. Every response carries the state of your window: On a 429, honour Retry-After. Generation is separately gated by your credit balance, which is usually the limit you will meet first.

​
Keeping keys safe

1

Server-side only

A key can spend your organization’s credits and publish to your creators’ accounts. Never ship one to a browser, a mobile app, or anything a user can read.
2

Environment, not source

CREATORLINE_API_KEY in your environment or secret manager. Never in a repository, never in a URL query string.
3

One key per consumer

A key per service, per environment, per developer machine. Then revoking one is a non-event instead of an outage, and the usage counters tell you who is spending what.