SudoMock

Authentication

All API requests require authentication via API keys. Learn how to generate, use, and manage your keys securely.

Overview

SudoMock uses API key authentication for all API requests. Each key is tied to your account and tracks usage against your credit balance. Excessive request rates may result in temporary 429 errors—see Error Handling for retry strategies.

API Keys

Generate multiple keys for different environments

Secure by Design

Keys are hashed, never stored in plain text

Revoke Anytime

Instantly revoke compromised keys

Generating API Keys

Generate API keys from the Dashboard. You can create multiple keys for different purposes:

  1. Navigate to Dashboard → API Keys
  2. Click "Generate New Key"
  3. Enter a descriptive name (e.g., "Production", "n8n Integration", "Development")
  4. Optionally set an expiration date
  5. Copy and save the key immediately-it's shown only once!

Save Your Key Immediately

For security, we only show the full API key once during generation. If you lose it, you'll need to generate a new key.

Using API Keys

Include your API key in the X-API-KEY header with every request:

API Key Header
1curl -X POST "https://api.sudomock.com/api/v1/renders" \
2  -H "X-API-KEY: sm_a1b2c3d4e5f6..." \
3  -H "Content-Type: application/json" \
4  -d '{ "mockup_uuid": "...", "smart_objects": [...] }'

Key Format

All SudoMock API keys follow this format:

Key Format
1sm_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0
2 │  └─────────────────────────────────────────────────────────────────┘
3 │                            64 character random string
4 └── Prefix: "sm_" identifies SudoMock keys

Test Your API Key

Verify your API key is working correctly and check your account status:

Test Your API Key

Verify your key works and check account status

Get your API key from the Dashboard

What this tests

This calls the /api/v1/me endpoint, which returns your account info, subscription status, and credit usage. Use this to validate your key before integrating with your application.

Security Best Practices

✓ Do

  • Store API keys in environment variables
  • Use separate keys for production and development
  • Rotate keys periodically (every 90 days recommended)
  • Set expiration dates for temporary access
  • Revoke unused keys promptly

✗ Don't

  • Commit API keys to version control
  • Share keys in chat or email
  • Use keys in client-side JavaScript
  • Use production keys for testing
  • Share a single key across multiple services

Environment Variables

Using Environment Variables
1# .env.local (Never commit this file!)
2SUDOMOCK_API_KEY=sm_your_production_key_here
3

4# In your code (Node.js example)
5const apiKey = process.env.SUDOMOCK_API_KEY;
6

7// Python example
8import os
9api_key = os.environ.get("SUDOMOCK_API_KEY")

Revoking Keys

If a key is compromised or no longer needed, revoke it immediately:

  1. Go to Dashboard → API Keys
  2. Find the key you want to revoke
  3. Click the Revoke button
  4. Confirm the action

Key Compromised?

If you suspect a key has been compromised, revoke it immediately and generate a new one. Check your usage logs for any unauthorized activity.

Authentication Errors

StatusMessageCause
401Missing API keyX-API-KEY header not provided
401Invalid API keyKey doesn't exist or is malformed
401API key revokedKey has been revoked
401API key expiredKey has passed its expiration date
401 Unauthorized Response
1{
2  "success": false,
3  "detail": "Invalid or missing API key"
4}

Ready to get started?

Generate your first API key and start rendering mockups.

Generate API Key