Bearer API Keys
Every KPainter OpenAPI endpoint except GET /health uses the user's API key:
Authorization: Bearer <your_api_key>Activate and copy a key from the API Key page.
Verify the Connection First
curl -s "https://api.kpainter.ai/openapi/v1/me" \ -H "Authorization: Bearer $KPAINTER_API_KEY"A successful response returns a safe account and plan summary. Verify this before creating content.
Store Keys Safely
- Keep each key in a server-side secret store or trusted agent connection.
- Never put a key in browser code, a mobile package, a screenshot, or logs.
- Do not use one shared key for unrelated end users.
- Never echo the full key in an error message.
- Ask the user to reconnect after a key reset.
Common Responses
- 401: the key is missing, invalid, or inactive.
- 403: the account cannot use the requested capability.
- 422: a field or parameter combination is invalid.
- 429: requests are too frequent; follow the response guidance before retrying.
- Insufficient balance: the creation reports a paused state, estimated credits, and an available action. Do not create a duplicate.
API-key activation, reset, and deletion remain on the KPainter website; the OpenAPI does not manage keys.