> ## Documentation Index
> Fetch the complete documentation index at: https://askeditor.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Get your API key

> Create a key, set it, scope it, test it.

Requests to AskEditor require authentication: you need an API key to call
templates from code, CI, or any agent that cannot sign in. (Connecting
Claude or another MCP client? You don't need a key at all: the
[connector](/docs/mcp/connect) signs in with OAuth.)

Keys are tied to a **workspace**, not a person. A key is minted inside the
workspace you're standing in, spends that workspace's credits, and stays
bound to it for life. It can never spend more than the workspace's balance,
and every call it makes is logged against it.

## Create your API key

<Steps>
  <Step title="Go to the dashboard">
    Navigate to [Workspace → Your Account → API Keys](https://askeditor.com/login?callbackUrl=%2Fworkspace%2Fprofile%2Fapi-keys).
    Signed in, the link goes straight to your keys; signed out, it takes you
    through sign-in and lands you there.
  </Step>

  <Step title="Create a key">
    Click **Add key**, give it a name you'll recognise later, and pick its
    [scopes](#key-scopes).
  </Step>

  <Step title="Copy your key">
    Copy the key immediately. **It is shown exactly once**: only its hash is
    stored, so nobody can retrieve it again, not you, not support. Lose it →
    revoke it and create another.
  </Step>
</Steps>

## Set your API key

Keys look like `ake_live_…`. Set yours as an environment variable:

<Tabs>
  <Tab title="macOS/Linux">
    ```bash theme={null}
    export ASKEDITOR_API_KEY="ake_live_…"
    ```
  </Tab>

  <Tab title="Windows (PowerShell)">
    ```powershell theme={null}
    $env:ASKEDITOR_API_KEY = "ake_live_…"
    ```
  </Tab>

  <Tab title=".env file">
    ```bash theme={null}
    ASKEDITOR_API_KEY=ake_live_…
    ```
  </Tab>
</Tabs>

Every call carries it in the `Authorization` header:

```bash theme={null}
Authorization: Bearer ake_live_…
```

<Tip>
  **Best practice**: keep keys in environment variables, never hardcoded, and
  never in client-side code. For browser apps, proxy calls through your
  backend. Separate keys for development and production make revocation
  painless.
</Tip>

## Key scopes

When creating a key you choose its scopes: they're frozen into the key, and
every endpoint requires one. A key without the needed scope gets the typed
`SCOPE_DENIED` blocker at estimate time, before any spend. Scopes only ever
carve *down* from what your account can already do.

| Scope            | What it allows                                         | Credits            |
| ---------------- | ------------------------------------------------------ | ------------------ |
| `recipes:read`   | See which templates exist: the menu, contracts, prices | free               |
| `jobs:read`      | Check the status of work already submitted             | free               |
| `blocks:read`    | Read the building blocks of a project                  | free               |
| `library:read`   | Browse assets already in the workspace                 | free               |
| `canvas:read`    | Read a canvas and its timeline                         | free               |
| `material:write` | Upload recordings, clips and photos to a project       | free               |
| `render:submit`  | Start cuts and renders                                 | **spends credits** |
| `export:submit`  | Export finished video                                  | **spends credits** |

<Info>
  Not sure what to pick? The two presets in the dialog cover most keys:
  **Read only** (safe for dashboards and monitoring) and **For skills**
  (`recipes:read`, `jobs:read`, `material:write`, `render:submit`: what an
  agent needs to make videos end to end). You can always create another key
  with more scope later.
</Info>

<Note>
  Some scopes deliberately do not exist yet: there is no `canvas:write`, no
  `social:publish`, and no `billing:*`. A key can never edit your canvases
  behind your back, post to your social accounts, or touch billing. Those
  capabilities are withheld from the scope vocabulary itself, so no
  combination of checkboxes can grant them.
</Note>

## Test your key

Verify it works with the identity call: it needs only `recipes:read` and
costs nothing.

```bash theme={null}
curl https://api.askeditor.com/api/mcp/v1/me \
  -H "Authorization: Bearer $ASKEDITOR_API_KEY"
```

A working key answers with your workspace, plan, remaining credits, and the
scopes this key holds:

```json theme={null}
{
  "projectName": "…",
  "plan": "…",
  "creditsRemaining": 27900,
  "scopes": ["recipes:read", "jobs:read", "material:write", "render:submit"]
}
```

## One account, one login method

<Warning>
  Signing in with Google and signing in with the same address by email create
  **two different accounts** with separate keys and credits. Pick one method
  and stay with it.
</Warning>