Authentication

API keys, scopes, expiry, and rate limits.

Authentication

Every request to the Ansdev API authenticates with an API key in the x-ansdev-key HTTP header. Keys are managed from your dashboard at /dashboard/api-keys.

curl -H "x-ansdev-key: ak_live_YOUR_KEY" \
  https://api.ansdev.cloud/v1/video

Key format

ak_live_ + 32 hexadecimal characters     (40 chars total)

Example: ak_live_7c1b1865ed225cf47377e7d21fdec972

The full key is shown once, at creation time. After that the dashboard only displays the 12-char prefix (ak_live_7c1b) for identification.

Scopes

Each key carries a set of scopes; today only video:read is generally available. Future-roadmap scopes are accepted by the API but hidden from the dashboard until their services ship.

Scope	Purpose
video:read	List, get, and mint playback tokens.
vault:read	(Coming soon) Cloud Vault file listing.
vault:write	(Coming soon) Cloud Vault uploads.
ai:compute	(Coming soon) AI agent runtime.
billing:read	(Coming soon) Read wallet balance.

A request whose key lacks the required scope returns 403 INSUFFICIENT_SCOPE.

Limits

• 10 active keys per user (revoke older ones to free a slot).
• 1,000 playback tokens per key per UTC day (default; configurable per key in future tiers).
• 5-minute TTL on every playback token.

See Rate Limits for the response-header contract.

Revocation

Click Revoke on the key’s card in the dashboard. Revoked keys return 401 INVALID_API_KEY on the very next request — there is no cache to flush. Revocation is a soft-delete (the row stays for audit), so the prefix and creation date remain visible.

Response envelope

{
  "success": true,
  "data": { /* … */ }
}

Errors share a single shape:

{
  "success": false,
  "error": {
    "code":    "INVALID_API_KEY",
    "message": "The provided API key is invalid or has been revoked.",
    "status":  401
  }
}

See the error catalog for the full list.

Treat your ak_live_… key like a password. Don’t paste it into client-side bundles destined for end-users — anyone who reads your page source can read your key. For browser embeds use the Player SDK, which holds the key only in memory and never persists it.