Getting started

Authentication

How to authorize API requests with x-api-key.

2 min read

Every request to the public v1 API must include your API key in the x-api-key header. There is no separate Bearer / OAuth flow.

1GET /v1/generations/abc123 HTTP/1.1
2Host: api.sixart.dev
3x-api-key: sa_2aadd27488941aa28539621b25d5d438...

Project binding

Each API key is permanently bound to a single project at creation time. Every successful request is automatically scoped to that project — you never pass a projectId in the body. To target a different project, create another key.

Permissions

Keys are scoped per module — for the public API, the relevant one is generations. Grant access: all for full read + write, or pick specific verbs (view, create) on the API keys page.

Rotating & revoking

If a key is compromised, revoke it from the API keys page. Revocation takes effect immediately — any further requests using that key return 401.

The full secret value is only shown once, at creation time. We store a hash of it on our side, so we can't recover it for you later.