Authentication

Every request to /v1 needs an API key in the Authorization header:

curl https://api.rawframe.dev/v1/models -H "Authorization: Bearer $RAWFRAME_API_KEY"

The SDKs read the key from the RAWFRAME_API_KEY environment variable, or take it as an option:

const rf = new RawFrame({ apiKey: process.env.MY_KEY });

Creating keysCopy Anchor Link

Create keys on the dashboard's API keys page. A key looks like rf_live_3f9k2qhb7m_..., belongs to one organization, and is shown once: we store only a hash of it, so a lost key can't be recovered. Revoke it and create another. Revoking takes effect within a minute.

Create one key per application or environment, so you can revoke one without touching the others, and so usage exports (which include the key id) show which application spent what.

ScopesCopy Anchor Link

Each key has scopes that limit what it can do. A request outside the key's scopes fails with 403 permission / missing_scope. Listing and reading models needs no scope.

A key that only generates and reads results needs generations:read, generations:write and, if it sends reference media, files:write.

Keeping keys safeCopy Anchor Link

• Call the API from your server. Never put a key in a browser, mobile app or public repository: anyone holding it can spend your credits.
• Store keys in your platform's secret manager or environment variables, not in code.
• If a key may have leaked, revoke it on the API keys page right away.
• Requests with a missing, malformed or revoked key fail with 401 authentication / invalid_api_key. Requests for a suspended organization fail with 403 / organization_suspended.