Get started
Authentication
API keys, where to get one and how to keep it safe.
API keys
An API key acts as you: videos it makes are yours, they are paid from your API balance and they show up in My creations. Keys look like qk_live_ followed by 40 letters and numbers.
Create and revoke keys in the Console (you need to be signed in). You can have up to 10 active keys — use one per app so you can revoke one without breaking the others.
Sending the key
Send it as a Bearer token on every request:
Header
Authorization: Bearer qk_live_…curl https://qulture-webapi-staging-381114038302.us-central1.run.app/api/v1/developer/me \
-H "Authorization: Bearer $QULTURE_API_KEY"What a key can do
| Allowed | Not allowed with a key |
|---|---|
| Create and read videos, images and uploads; templates, camera moves, voices; your balance (/developer/me) | Top-ups and billing settings, buying plans or credits, posting to the Qulture feed, Qulture Avatars sharing and approvals, managing keys, any non-Studio Qulture API |
Calls that aren't allowed return 403 developer_scope_denied. Do those in Qulture Studio while signed in.
Keeping keys safe
- Keep keys on your server. Never put them in a mobile app, a browser bundle or a public repo.
- Store them in environment variables or a secrets manager.
- Use a separate key per app or environment, with a clear name.
- If a key leaks, revoke it in the Console — it stops working immediately — and create a new one.
- Check "Last used" and "Requests" in the Console to spot keys you no longer need.