QuickstartMarkdown
Authentication
Generations need an API key, sent as a bearer token. Keep it on your server. The model list, status and price estimate need no key.
export VIDLAB_API_KEY="vidlab_sk_your_key_here"
curl https://vidlab.ai/v1/balance \
-H "Authorization: Bearer $VIDLAB_API_KEY"import os, requests
r = requests.get(
"https://vidlab.ai/v1/balance",
headers={"Authorization": f"Bearer {os.environ['VIDLAB_API_KEY']}"},
)
print(r.json())const res = await fetch("https://vidlab.ai/v1/balance", {
headers: { Authorization: `Bearer ${process.env.VIDLAB_API_KEY}` },
});
console.log(await res.json());| Header | What it is |
|---|---|
Authorization | Bearer vidlab_sk_.... The key starts with vidlab_sk_. |
x-api-key | The same key, for clients that cannot set Authorization. |
Make a key
Keys are made in the dashboard, from a signed-in browser: open API keys, accept the Developer API terms and create one. An API key cannot make other keys.
- The full key is shown once, when you create it. VidLab stores only a hash, so a lost key cannot be shown again: make a new one.
- You can keep up to 25 live keys. Delete a key on the same page to revoke it at once.
- Keys have full access: they start and poll generations, read the balance and use the MCP endpoint.
Keep it safe
- Put the key in an environment variable (
VIDLAB_API_KEY) or your platform's secret store. Never in source code, a committed file, a URL or a prompt. - Call the API from your server, never from a browser or a mobile app, where anyone can read the key.
- Use one key per app, so you can revoke one without breaking the rest. If a key leaks, delete it straight away.
When it fails
| Status | Code | Why |
|---|---|---|
| 401 | unauthorized | The key is missing, unknown, revoked or expired. |
| 403 | api_key_required | Generations take a vidlab_sk_ key only; another kind of token was sent. |
| 403 | developer_access_forbidden | The account does not have API access yet. Write to support@vidlab.ai. |