Authentication

All Edit Square endpoints are authenticated using API keys as a bearer token:

curl --request GET \
  --url 'https://healthy-lark-490.eu-west-1.convex.site/v1/renders?project_id=proj_j123456789' \
  --header 'Authorization: Bearer sk_your_key_here'

const url = 'https://healthy-lark-490.eu-west-1.convex.site/v1/renders?project_id=proj_j123456789';
const options = {
  method: 'GET',
  headers: { Authorization: 'Bearer sk_your_key_here' },
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

Full request and response documentation can be found in the renders api reference section.

Any request with no Authorization header will be rejected with 401.

Getting a key

Keys are created in the dashboard:

Open the dashboard and click your avatar in the bottom-left.
Choose API Keys.
Create a key and give it a name you will recognise later.

Keys look like sk_ followed by 32 characters. The dashboard shows a masked form (sk_1a2b3…cdef), which is enough to tell two keys apart and not enough to use one.

What a key can reach

A key belongs to the person who created it and carries that person’s access: it reaches the projects their teams can reach, and nothing else. It is not scoped to a project, and it is not shared across a team - two people on one team hold two different keys, and revoking one leaves the other working.

GET /v1/me answers which user a key acts as, which is the quickest way to tell two keys apart when a request is not returning what you expected.

That makes revocation the tool for everything: someone leaves, a key leaks, a script is retired - revoke that key and create a new one.

Keeping keys safe

Treat a key like a password: server-side only, out of git, out of the browser. Anyone holding it can render against your team’s projects and spend the team’s credits.
Give each integration its own named key, so one can be revoked without stopping the others.
Revoking is immediate and permanent - the next request with that key fails.