x-api-key header. Keys start with
sm_.
Get a key
Keys are issued on the API keys page of the dashboard. The secret is shown in full once, at creation, so copy it then into wherever your service reads its secrets. Issue one key per integration and name it after the thing that holds it, so a leak costs you that integration and not the rest of your business. Create and revoke your API keys walks through issuing, binding and revoking.Check that a key works
GET /api/v1/me returns the account behind the key under data.account, the
plan under data.subscription and the remaining credits under data.usage. It
is the cheapest way to confirm a key is live.
Try it
Run the call against your own key from the reference.
Keep the key on your server
The key authorises renders and spends credits, so it belongs in your backend or in an environment variable, never in client-side code or a public repository. If a key is exposed, replace it from the dashboard and update the environments that hold it.Requests from a browser
Embedded editor sessions do not use your API key in the browser. Your server creates a Studio session and the browser receives a short lived token instead, so the key never leaves your infrastructure.When a key is rejected
A missing, malformed or revoked key returns401. The body follows the standard
error shape described in Errors.
Next steps
Render your first mockup
Upload a file once, then render it over HTTP.
Base URL and response codes
The host every call goes to, and what each status means.
Rate limits and concurrency
The ceilings a key works inside, and the headers that report them.
Manage keys in the dashboard
Issue, watch, bind to a domain, revoke.