Authentication
Keys
Create keys under Account → API keys: give each one a name (the server it lives on, or what it is for), up to ten active keys per account. The secret is shown once; we keep only a fingerprint and the first characters, so it cannot be shown again. Lose it, revoke it, make another.
Send it as a bearer token:
curl https://trycutstack.com/v1/account \
-H "Authorization: Bearer csk_live_Ab12Cd34…"GET /v1/account is a good first call: it answers your balance and confirms which key is speaking (auth.key is the key’s display prefix).
When a key is wrong
A missing header is 401 UNAUTHENTICATED; a malformed, unknown or revoked key is 401 INVALID_KEY. Both are application/problem+json (see Errors). A request that carries a bearer is judged on the bearer alone: a browser session cookie riding along never rescues a dead key, so your client learns at once when a key was revoked.
Revoking
Revoke from the same page. It takes effect on the next request that carries the key. Revoked keys stay listed, greyed out, so “which key was that” has an answer. Deleting the account revokes every key.
What a key cannot do
- Create or revoke keys.
- Buy credits or redeem a licence code.
- Delete the account.
Those need a signed-in session in the studio; a leaked key can spend your credits, but it cannot mint more keys or close the account.
The key is a secret. Keep it in server-side configuration, never in a browser, a mobile app or a repository. The API sends no CORS headers on purpose: it is not meant to be called from a web page.
Limits per key
60 requests per minute and 2,000 photos per hour, per key. Over the limit you get 429 RATE_LIMITED with a Retry-After header. Batches running at the same time are counted per account, not per key. All numbers on Limits and rules.
Next: Credits. What is charged, what is refunded, in which order.