Skip to main content

Authentication

The SpAItial Developer API uses bearer tokens. Every request must include an Authorization header carrying a key issued to your account.

Obtaining a key​

  1. Create a key in the dashboard

    Keys are created from the developer portal in the SpAItial dashboard. Each key belongs to your account and spends from the same shared credit balance used by the app.

  2. Pick the right scopes

    Each key has an explicit scope set (for example worlds:create, worlds:read, worlds:write, files:create). The scope is enforced server-side; calls outside the granted scopes return 403 forbidden. Panorama edits use worlds:create; listing, reading, or downloading edited panoramas uses worlds:read.

  3. Check your credits

    World generation spends from your shared app and API credit balance. See Credits and Billing for plan credits, purchases, and what API actions cost.

Key format​

Production keys look like:

spt_live_abc123def456...

Test or sandbox keys (if your workspace has them enabled) use a different prefix. The prefix is part of the key and must be sent verbatim.

Sending the key​

Pass the key in the standard Authorization: Bearer <key> header:

curl https://api.spaitial.ai/v1/models \
  -H "Authorization: Bearer spt_live_..."

A request with no Authorization header, an unparseable header, or a revoked key returns 401 unauthorized with the error codes.

Revoking​

Revoke any key that may have leaked from the developer portal. Revocation takes effect on the next request. To replace a key, create a new one and revoke the old one explicitly; creating a new key does not invalidate existing ones.

What not to do​