Authentication

Two credentials, for two kinds of caller — and both resolve through the same identity path to the same account, which you can prove to yourself with GET /v1/me.

API keys

Everything that is not a browser — your own code today, the Godot plugin and MCP server when they ship in a few weeks — authenticates with a bearer key:

Authorization: Bearer gsk_...

Keys are made in the workshop under Settings → API keys, or with POST /v1/keys — the only response that ever carries the secret. It is hashed on write and cannot be read back afterwards: a lost key is replaced, not recovered. GET /v1/keys lists what exists on the account without any secrets, and revoking one with DELETE /v1/keys/{id} takes effect immediately — requests already in flight are not interrupted.

The session cookie

The web frontend authenticates with the session cookie set on .gensprite.ai and sent automatically. It exists for the browser and only the browser; nothing you build needs to know more about it than that both credentials land on the same account.

Where keys should live

A key names the account it spends from, so treat it like the credit balance it can reach: environment variables and secret stores, never a client bundle and never a repository. The Godot plugin will keep its key in the editor's settings for the same reason — outside the project folder that gets committed.