Authentication

Every request to a generation endpoint is authenticated with two headers:

x-client-id: sok_live_xxxxxxxxxxxxxxxxxxxxxxxx
x-client-secret: <your secret>

Both headers are required on every request. There is no bearer token, session, or cookie for these endpoints — the client id and secret together are your credential.

WARNING

Treat x-client-secret like a password. It is shown to you exactly once, at creation, and cannot be retrieved afterward. Never put it in front-end/browser code — call the Sloyd API from your own back end.

Getting a key

Keys are issued from the API Dashboard (sign in with your Sloyd account):

1. API Keys → set up API billing if you haven't already. This requires a prepaid credit balance — see Pricing & Credits.
2. Click Generate Key and give it a label (e.g. production, staging).
3. Copy the clientSecret shown on screen. It will not be shown again — only the client id and the secret's last 4 characters remain visible afterward.

You can create multiple keys (e.g. one per environment) and revoke any of them independently from the same page. Revoking a key invalidates it immediately — the next request made with it returns 401.

Live vs. test keys

Keys can be created as live or test — both authenticate identically. Note that, today, test keys draw from the same prepaid credit balance and run the same generation pipeline as live keys; there is no separate free sandbox. Use test keys to separate credentials by environment, not to avoid being charged.

Rate limits

Temporary rate limit during API test

While the API is in test, each key (x-client-id) is limited to 5 concurrent jobs (status pending or running). A request that would exceed this returns 429 Too Many Requests until an earlier job finishes. This limit is temporary and subject to change as the API moves out of test.

There is no request-per-second or per-minute limit today — only the concurrency cap above. See Errors for the full response shape.

Error responses

Status	When
401 Unauthorized	x-client-id or x-client-secret is missing, or the pair doesn't match an active key
429 Too Many Requests	More than 5 concurrent jobs on the same key (temporary limit — see Rate limits)

{ "statusCode": 401, "message": "Both API client ID and secret are required" }

{ "statusCode": 401, "message": "Invalid API credentials" }

See Errors for every status code the API can return.