Bearer authentication
Pass the secret key in the standard Authorization header:
Authorization: Bearer <GENSTA_API_KEY>GET /v1/models is public. Generation routes require a valid key. Media-upload routes are available only when uploads are enabled for the project; otherwise use stable HTTPS URLs.
Scopes
| Scope | Allows |
|---|---|
| generations:write | Create generations, reserve uploads, and complete uploads |
| generations:read | Read generation and media-upload status |
A missing or invalid key returns 401 authentication_required. A valid key without the needed scope returns 403 forbidden.
Key security
- Store the key in a secret manager or server environment variable, not source control.
- Call Gensta from your backend. Do not embed a secret key in websites, mini apps, or iOS/Android binaries.
- Use separate keys for independent environments.
- Treat request prompts and media URLs as sensitive application data.
Key management
Manage project keys in platform.gensta.ai. A newly created secret is displayed only once. Revocation is immediate; create a replacement before revoking a key that still serves production traffic.
Read the current balance
/v1/balanceBearer key · generations:read{
"currency": "USD",
"available": "42.500000",
"held": "1.250000"
}Top up your API balance in the portal: Russian cards via YooKassa (RUB), or international cards via Tribute (USD), when enabled. Tribute is a one-time payment, with no subscription; the selected USD amount is credited in full after verification. Closing the payment page does not cancel or repeat a payment. Your balance updates after confirmation.
available can fund new generations; held is temporarily reserved by active generations. Create and status responses expose that generation's reserve or final charge in billing. They do not embed the current wallet balance because other requests may change it concurrently—call GET /v1/balance when you need a fresh value.