Authentication

Every API request is authenticated with an API key — a 71-character secret of the form aiv_sk_<64 hex>, created on the developer dashboard. Send it either way:

bash

curl "https://api.aiveed.io/v1/auth/me" -H "X-API-Key: $AIVEED_API_KEY"
# or
curl "https://api.aiveed.io/v1/auth/me" -H "Authorization: Bearer $AIVEED_API_KEY"

Keys are never accepted in the query string (?api_key= returns 401) — secrets must not land in server logs.

Key lifecycle

Create — dashboard, or POST /v1/auth/keys with a session JWT. Requires a verified email and an unbanned account. Up to 5 active keys per account; optional expires_in_days auto-expires a key.
Rotate — POST /v1/auth/keys/{id}/rotate mints a new secret and invalidates the old one immediately. The new secret is shown once.
Revoke — DELETE /v1/auth/keys/{id}. Irreversible; the key stops authenticating at once.

Key management is session-only: those routes require the dashboard login JWT. An API key that tries to create, rotate, or revoke keys gets 403 insufficient_scope — a leaked key can never mint more keys.

Scopes

Scope	Grants
`generate`	Job creation: /generate/*, /extend/video, /batch, /uploads, /webhooks management
`read`	Reads: /jobs, /videos, /images, /credits, /usage/*, SSE tickets and streams

Keys are created with both scopes today. A request outside the key's scopes returns 403 insufficient_scope with required_scope naming the missing one.

Request limits

JSON bodies are capped at 1 MB (413 PAYLOAD_TOO_LARGE); media goes through /v1/uploads instead. See rate limits & tiers for request throttles.