A key to your
creative world.
Scoped keys, private workspaces, and access you can revoke whenever you want.
Browser accounts use an HttpOnly session cookie. Programmatic requests use a Bearer key. API keys cannot change profile details, manage accounts, or create other keys.
Bearer authentication
Send the key in the Authorization header on every API request. Never embed it in frontend code, URLs, native project files, or shared examples.
curl https://vunoblade.com/api/v1/projects \
-H "Authorization: Bearer $VUNOBLADE_API_KEY"Choose the smallest permission set
| Scope | Allows |
|---|---|
| projects:read | List projects; read native documents and uploaded media |
| projects:write | Create, update, or delete projects; upload source media |
| editor:read | Read your active editor sessions, document context, and receipts |
| editor:write | Queue edits for your open native artwork |
Create. Use. Rotate.
Create keys under Account → API keys. The server stores only a SHA-256 hash. You can keep up to ten active keys. Revocation takes effect on the next request. Keys do not currently expire automatically; create a replacement, update your integration, then revoke the previous key.
Manage keysBrowser sessions
Sessions last seven days. Signing out revokes the current session; changing your password revokes all browser sessions and signs this browser in again. API keys remain valid until revoked. Browser mutations require the configured same-origin header. Production mode additionally requires HTTPS and sets Secure cookies.