Guide

Authentication

API key format, the X-Api-Key header, rotation and revocation.

Every request carries an API key in the X-Api-Key header. There is no OAuth flow, no token exchange and no expiry.

bash

curl https://api.roomagen.com/api/v1/account \
  -H "X-Api-Key: rmg_live_YOUR_KEY"

Key format

A key is the prefix rmg_live_ followed by 64 hexadecimal characters. Send the whole string, prefix included.

Keys are stored hashed. The portal shows a key once, at creation time, and afterwards only its first few characters so you can tell two keys apart in a list.

Server-side only

Never put a key in browser JavaScript, a mobile app bundle, or anything else you ship to a user. Anyone who reads the key can spend your image balance. Call the API from your own backend and keep the key in a secret store or environment variable.

Rotating a key

There is no rotate button, and that is deliberate — rotating in place would break every caller at once. Instead:

Create a second key in the portal.
Deploy it to your servers.
Revoke the old key once nothing is using it.

Creating a second key does not grant another 50 free images; the free grant applies to your first key only.

An account can hold up to 10 active keys at once. If you hit that limit, revoke one you no longer use to free a slot — a revoked key does not count against it.

Revoking a key

Revoke a key in the portal the moment you suspect it leaked. Revocation takes effect immediately and cannot be undone — a revoked key never becomes valid again, so issue the replacement first.

When a key is rejected

Code	Status	Description
`invalid_api_key`	401	The `X-Api-Key` header is missing, malformed, or does not match a key. Check the header name and that you sent the full key including the `rmg_live_` prefix.
`key_revoked`	401	The key was revoked, or the account behind it is disabled. Create a new key — a revoked key never becomes valid again.
`api_disabled`	404	The API is switched off server-side. Every route answers this, including requests carrying a valid key. There is nothing to retry.

Branch on code, never on message. The full catalogue is on Errors & limits.

Next step

Jobs — the full reference for creating and reading jobs.