Bearer authentication
Pass the secret key in the standard Authorization header:
http
Authorization: Bearer <GENSTA_API_KEY>GET /v1/models is public. Generation routes require a valid key. Media-upload routes additionally require the private-upload capability; during closed alpha external projects should pass stable HTTPS URLs instead.
Scopes
| Scope | Allows |
|---|---|
| generations:write | Create generations, reserve uploads, and complete uploads |
| generations:read | Read generation and media-upload status |
A missing or invalid key returns 401 authentication_required. A valid key without the needed scope returns 403 forbidden.
Key security
- Store the key in a secret manager or server environment variable, not source control.
- Call Gensta from your backend. Do not embed a secret key in websites, mini apps, or iOS/Android binaries.
- Use separate keys for independent environments when key management becomes available.
- Treat request prompts and media URLs as sensitive application data.
Key management
Manage project keys in platform.gensta.ai. A newly created secret is displayed only once. Revocation is immediate; create a replacement before revoking a key that still serves production traffic.