Developers
API Keys
Provision API Keys for the REST API, configure Scopes and lifetimes, and manage rotation and revocation.
An API Key authorizes scripts and backend services to interact with the REST API on your behalf, constrained to designated Scopes. Keys are provisioned and managed under Account › API Keys.
Create an API Key
Open API Keys
Navigate to Account › API Keys and select Create key.
Name it
Assign a descriptive Name to identify the owning script, server, or integration.
Select Scopes
Under Scopes, select read or write access per resource domain. Restrict scopes to the minimum permissions required.
Set expiration
Under Expires, select a lifetime duration in days or Never. Expired keys are rejected immediately upon expiration.
Copy the key
Select Create key. The plaintext key is displayed once. Copy and store it in a secure secret store or environment configuration before closing the dialog.
Keys use a product slug prefix followed by _sk_, facilitating detection in static analysis and secret scanners.
Scopes
| Domain | Read | Write |
|---|---|---|
| Profile | profile:read: name, email, avatar | profile:write: change name and avatar |
| Credits | credits:read: balance and history | Not applicable |
| Generations | generations:read: status and outputs | generations:write: start generations that spend Credits |
| Creations | creations:read: saved creations | creations:write: share, unshare and remove |
| Uploads | uploads:read: uploaded files | uploads:write: upload new files |
| Billing | billing:read: orders and subscription | billing:write: start Credit Pack checkouts |
| Support | support:read: your requests | support:write: submit requests |
| Webhooks | webhooks:read: endpoints/deliveries | webhooks:write: manage webhook endpoints |
generations:write consumes Credits
Keys with generations:write can start Generation Jobs that deduct Credits
from your account. Restrict these keys to secure backend infrastructure.
billing:write only starts a checkout (or a change to an existing subscription); it returns a confirmation URL that requires human completion. Keys cannot execute financial charges directly.
Authentication
Pass the key in the HTTP Authorization header as a bearer token:
curl https://ximagesplitter.com/api/v1/credits/balance \
-H "Authorization: Bearer $API_KEY"Missing, malformed, expired, or revoked keys return 401 Unauthorized. Keys lacking the required Scope return 403 Forbidden (insufficient_scope). API Keys apply strictly to the REST API; MCP endpoints require OAuth 2.1 authentication.
Rotation and revocation
The key list details each key's assigned Scopes, expiration timestamp, and Last used timestamp.
- Rotate: provisions a new key with identical metadata and Scopes while revoking the existing key immediately. Update consuming environments with the replacement secret immediately.
- Revoke: permanently deactivates the key. All subsequent requests fail immediately.
Revoke keys immediately if compromised or decommissioned.
Security practices
- Never expose API Keys in client-side code, mobile applications, or public repositories.
- Use isolated keys per service to allow independent revocation without collateral impact.
- Prefer explicit expiration lifespans, and assign read-only Scopes where sufficient.
- API Keys can only be created and managed via the authenticated account UI, never through the API itself.