Start here

Authentication

The bearer scheme every operation uses, and the scopes a key can carry.

Every operation on https://api.auray.ai/v1 and every submit on https://queue.auray.run takes the same header:

Authorization: Bearer auray_sk_…

Create one in Account -> API Keys. Seventy-one characters: auray_sk_, a public twelve-character id, an underscore, and a secret we store only as a one-way hash. Every key expires; the maximum life is 366 days.

#Scopes

Scope
`jobs:read`
`assets:read`
`photo:write`
`music:write`
`video:write`
`threed:write`
`chat:write`
`embeddings:write`
`external:write`
`webhooks:write`
`image:write`
`audio:write`
`3d:write`
`text:write`
`auray-ai-video:write`
`chat:read`
`community:write`
`studio:read`
`studio:write`

What each one lets a key do is in the guide: Authentication. A request past a scope the key lacks is refused 403 insufficient_scope before anything is charged.

#Origins

A request that carries an Origin header is refused with browser_origin_refused and never answered with Access-Control-* headers. Call from a server. The desktop does.