> ## Documentation Index
> Fetch the complete documentation index at: https://sudomock.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> The base URL is https://api.sudomock.com.
> Authenticate every request with the x-api-key header. Keys begin with sm_.
> A render returns the finished image at data.print_files[0].export_path. A request sent with is_async true returns a job_id to poll at GET /api/v1/jobs/{job_id}.
> Prefer the official SDKs over hand-written HTTP calls: npm install sudomock for Node, pip install sudomock for Python.

# Authentication

> How SudoMock identifies your requests.

Every request carries your API key in the `x-api-key` header. Keys start with
`sm_`.

```
x-api-key: sm_your_api_key
```

[Quickstart](/docs/quickstart) puts that header on a first render, and the
[SDKs](/docs/sdks) set it for you from an environment variable.

## Get a key

Keys are issued on the
[API keys page of the dashboard](https://sudomock.com/dashboard/api-keys). The
secret is shown in full once, at creation, so copy it then into wherever your
service reads its secrets.

Issue one key per integration and name it after the thing that holds it, so a
leak costs you that integration and not the rest of your business.
[Create and revoke your API keys](/docs/dashboard/api-keys) walks through issuing,
binding and revoking.

## Check that a key works

`GET /api/v1/me` returns the account behind the key under `data.account`, the
plan under `data.subscription` and the remaining credits under `data.usage`. It
is the cheapest way to confirm a key is live.

<Card title="Try it" icon="play" href="/docs/api-reference/account/retrieve-the-current-account">
  Run the call against your own key from the reference.
</Card>

## Keep the key on your server

The key authorises renders and spends credits, so it belongs in your backend or
in an environment variable, never in client-side code or a public repository.

If a key is exposed, replace it from the dashboard and update the environments
that hold it.

## Requests from a browser

Embedded editor sessions do not use your API key in the browser. Your server
creates a [Studio session](/docs/api-reference/studio/create-a-new-studio-session)
and the browser receives a short lived token instead, so the key never leaves
your infrastructure.

## When a key is rejected

A missing, malformed or revoked key returns `401`. The body follows the standard
error shape described in [Errors](/docs/errors).

## Next steps

<CardGroup cols={2}>
  <Card title="Render your first mockup" icon="rocket" href="/docs/quickstart">
    Upload a file once, then render it over HTTP.
  </Card>

  <Card title="Base URL and response codes" icon="terminal" href="/docs/api-reference/introduction">
    The host every call goes to, and what each status means.
  </Card>

  <Card title="Rate limits and concurrency" icon="gauge" href="/docs/api-reference/usage-limits">
    The ceilings a key works inside, and the headers that report them.
  </Card>

  <Card title="Manage keys in the dashboard" icon="key" href="/docs/dashboard/api-keys">
    Issue, watch, bind to a domain, revoke.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.