Authentication

All API requests require an API key in the Authorization header.

Using Your API Key

curl 'https://api.smavatar.com/api/v1/...' \
  -H 'Authorization: Bearer sma_your_api_key'

API keys start with sma_ followed by 32 random characters.

Projects and Keys

Organization (your account)
└── Project
    └── API Keys (multiple per project)
        └── Jobs

Create multiple projects to separate applications. Create multiple keys per project for different environments (dev, staging, production).

Create an API Key

1. Open your project in the dashboard
2. Go to API Keys tab
3. Click Create API Key
4. Copy the key immediately—you won't see it again

Rate Limits

Exceeding limits returns 429 Too Many Requests with a Retry-After header.

Security Best Practices

Do:

• Store keys in environment variables
• Use different keys for dev/staging/production
• Rotate keys periodically
• Revoke compromised keys immediately

Don't:

• Commit keys to version control
• Expose keys in client-side code
• Share keys in chat or email

Environment Variables

# .env (never commit)
SMAVATAR_API_KEY=sma_your_key_here
SMAVATAR_PROJECT_ID=your-project-uuid

// Node.js
const apiKey = process.env.SMAVATAR_API_KEY

# Python
import os
api_key = os.environ.get('SMAVATAR_API_KEY')

Revoking Keys

If a key is compromised:

1. Go to your project → API Keys
2. Click Revoke on the compromised key
3. Create a new key
4. Update your applications

Revoked keys stop working immediately.

Error Responses

Invalid API Key (401)

{
  "statusCode": 401,
  "message": "Invalid API key"
}

Wrong Project (403)

{
  "statusCode": 403,
  "message": "API key does not have access to this project"
}

Next Steps