Authentication and keys
Send a Sume API key on every request to the public API.
Every request to the public API carries an API key. Requests without one get 401 unauthorized.
Send the key
Use either header:
Send one of them, not both. Keep keys on your server: a key in a browser or a mobile app can be copied and spent.
Your key
Make keys in open.sume.com → API keys. A key spends your open.sume.com balance, in US dollars. It calls the model API and nothing else:
| Area | Operations |
|---|---|
| Images | Generate, list models, get a model |
| Video | Generate, list models, get a model |
| Jobs | Status, result, get, list, cancel, events and webhook redelivery |
| Uploads | Direct upload of your own image or video |
| Prices | Open models and estimates (these two need no key) |
Any other route answers 403 open_key_route_not_allowed:
Keys made in a team (an organization) belong to the team. Every member can use them, and their runs spend the team's balance.
One host
Every call in these docs goes to https://api.open.sume.com. It takes API keys only: a signed-in browser session sent there gets 401 session_not_accepted. Each response names the host that answered in the x-sume-api-surface header (public).
Rotate a key
Create the new key, deploy it, then revoke the old one in the dashboard. A revoked key gets 401 unauthorized at once.