Documentation / Getting started
Authentication
Use a project-scoped API key or an MCP OAuth token with the same API.
Create an API key
Open a project → Developer API → Create API key. Choose Read or Write, or expand Advanced permissions for individual scopes. Choose an expiry or Never. Copy the token once and save it in your CI secret manager. Keys created in the project UI can only access that project; revoke a key when its workflow no longer needs access.
Authentication and requests
Use Authorization: Bearer YOUR_API_KEY with /api/v1. MCP OAuth tokens use the same API. Create a project-restricted CI key with asset upload, design read/write and export permissions.
Send JSON and an Idempotency-Key on every mutation. Reuse the same key and exact input after a network failure. Changed input returns 409. Receipts are retained for at least 24 hours. Unknown outcomes stay reserved until investigated.
Successful responses contain data and meta.requestId. Errors use application/problem+json with a stable code, detail and requestId. Respect Retry-After on 429 and status polls. Limits are shared across an account: 120 requests, 30 content mutations and 10 render mutations per minute.