genkiln

Authentication

Authenticate every genkiln API request with a secret API key sent as a Bearer token.

Every request to https://genkiln.com/v1 (except listing models) needs an API key in the Authorization header:

HTTP
Authorization: Bearer sk_...

Create and manage keys

  • Create keys in Console → API Keys. A new key starts with sk_ and is shown once. We store only a hash, so we cannot show it to you again.
  • You can create several keys (for example one per environment or per service) and delete any of them at any time. A deleted key stops working right away.
  • The console shows when each key was last used. This timestamp is updated at most once a minute, so it is approximate.
  • All keys on an account share the same credit balance, tasks and webhook signing secret.

Check that your key works

GET /v1/balance is a cheap way to test a key. It returns your current credit balance:

curl https://genkiln.com/v1/balance \
  -H "Authorization: Bearer $GENKILN_API_KEY"
JSON
{ "object": "balance", "credits": 9640, "usd": 9.64 }

credits is your spendable balance; usd is the same amount at 1 credit = US$0.001.

Errors

A missing, malformed, deleted or expired key returns 401:

JSON
{
  "error": {
    "code": "invalid_api_key",
    "message": "The API key is invalid, deleted or expired.",
    "request_id": "req_01JC8ZM2D5S1R0FQ7W3KX9YB4T"
  }
}

The header must be exactly Bearer <key>. Keys passed in the query string or request body are ignored.

Keep keys secret

An API key can spend your credits. Call the API from your own server, never from a web page or mobile app where users could read the key.

  • Store keys in environment variables or a secret manager, not in source control.
  • If a key leaks, create a new one, switch your app over and delete the old key.
  • Use separate keys for development and production so you can revoke one without touching the other.

Public endpoints

GET /v1/models and GET /v1/models/{id} work without a key, so you can show the catalog and prices in your own app. See Models.