Getting started
Authentication
One bearer token on every request. Keys are issued in the partner dashboard and scoped to your account — everything you create belongs to you alone.
The header
Every endpoint under /api/partner/v1/ requires an Authorization header with your full key:
Authorization: Bearer pmat_1a2b3c4d5e6f_9f8e7d6c…Keys look like pmat_<key id>_<secret>. The whole string is the credential — send it exactly as issued. There are no cookies, signatures, or timestamps involved.
Getting your key
Keys are minted in the partner dashboard, where you can also reveal the current key (signed-in only) and rotate it. Rotating issues a new key and kills the old one immediately — do it any time you suspect a leak, then update your secrets manager.
Call the API from your backend, never from your users' browsers or mobile apps — anyone holding the key can spend your credits. (The “Try it” boxes in these docs run from your browser as a convenience for testing; that's you spending your own credits, not a pattern to ship.)
What failures look like
A missing or unrecognized key returns 401 with a JSON error:
{ "error": "Missing Authorization Bearer token" }
// or
{ "error": "Unauthorized" }Two things worth knowing about how authorization behaves across the API:
- Ownership is absolute. Characters, voices, assets, and jobs are scoped to the key's account. You can never see or use another client's resources.
- Existence is never leaked. Requesting a resource that belongs to someone else returns the same
404as one that doesn't exist at all.
Check your key
The cheapest sanity check is GET /usage/summary — free, instant, and returns your balance. The sidebar's Test key button does exactly this, or run it here: