Skip to main content

​
Get your API key

1

Sign up

Create an account at platform.decart.ai
2

Create an API Key

Navigate to API Keys and create a new API Key
3

Copy key

Copy your API key

​
Use your API key

Pass your API key when making requests: 
# Submit job
JOB_ID=$(curl -s -X POST https://api.decart.ai/v1/jobs/lucy-pro-v2v \
  -H "X-API-KEY: $DECART_API_KEY" \
  -F "[email protected]" \
  -F "prompt=Transform to anime style" | jq -r '.job_id')

# Poll status and download when complete
while [ "$(curl -s -H "X-API-KEY: $DECART_API_KEY" \
  https://api.decart.ai/v1/jobs/$JOB_ID | jq -r '.status')" != "completed" ]; do sleep 2; done

curl -H "X-API-KEY: $DECART_API_KEY" \
  https://api.decart.ai/v1/jobs/$JOB_ID/content --output transformed.mp4

​
Best practices

Never hardcode API keys in your code. Use environment variables.
  • Store keys in environment variables
  • Rotate keys regularly
  • Use different keys for development and production

​
Client Tokens for Realtime API

When building client-side applications (browsers, mobile apps) that connect to the Realtime API via WebRTC, you should use client tokens instead of your permanent API key.

​
Why use client tokens?

Client tokens are short-lived API keys designed for client-side use:
  • Safe to expose: Can be sent to browsers and mobile apps
  • Short TTL: Expire after 10 minutes, limiting exposure window
  • Limited scope: Cannot create other tokens
  • Session-aware: Expired tokens prevent new connections but don’t disconnect active sessions
Never expose your permanent API key in client-side code. Use client tokens for all browser and mobile app connections.

​
How it works

  1. Your backend creates a client token using your permanent API key
  2. Your backend passes the client token to the frontend
  3. The frontend uses the client token to authenticate the WebRTC connection
Client tokens flow diagram

​
Creating client tokens

Create client tokens from your backend using the SDK: 
import { createDecartClient } from "@decartai/sdk";

const client = createDecartClient({
  apiKey: process.env.DECART_API_KEY,
});

const { apiKey, expiresAt } = await client.tokens.create();
// apiKey: "ek_abc123..." (send this to your frontend)
// expiresAt: "2024-01-15T10:30:00.000Z"

​
Best practices for client tokens

  • Generate client tokens on-demand when users need realtime access
  • Never log or persist client tokens on the client side
See the JavaScript Realtime SDK and Python Realtime SDK for complete integration examples.

​
Need help?