Authentication

All AirCube API requests require authentication via an API key passed as a Bearer token.

API key format

AirCube API keys use the prefix sk- followed by a unique identifier:

sk-a1b2c3d4e5f6...

Using your API key

Include your API key in the Authorization header of every request:

curl https://aircube.ai/api/v3/status/gen_abc123 \
  -H "Authorization: Bearer sk-your-api-key-here"

import requests

headers = {
    "Authorization": f"Bearer {os.environ['AIRCUBE_API_KEY']}",
    "Content-Type": "application/json",
}

response = requests.post(
    "https://aircube.ai/api/v3/seedream-v5.0-pro/text-to-image",
    headers=headers,
    json={"prompt": "a sunset over mountains"},
)

const response = await fetch(
  "https://aircube.ai/api/v3/seedream-v5.0-pro/text-to-image",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.AIRCUBE_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ prompt: "a sunset over mountains" }),
  }
);

Obtaining an API key

Step 1: Sign up

If you don't have an account yet, go to aircube.ai/signup and create one. New accounts include free credits — no credit card required.

Step 2: Open the API Keys page

Log in and navigate to API Keys in your dashboard (left sidebar → API Keys).

Step 3: Create a key

Click the "+ Create API key" button. You can optionally give the key a name (e.g. "Production", "Dev") to help you identify it later.

Step 4: Copy the key

The full API key (starting with sk-) is displayed only once after creation. Copy it immediately and store it in a secure place, such as an environment variable:

export AIRCUBE_API_KEY="sk-your-api-key-here"

If you lose the key, you'll need to create a new one — the original cannot be retrieved.

Key management

You can manage your API keys from the API Keys page. The page shows all your keys with their name, key prefix, creation date, and last used date.

• Create — click "+ Create API key" to generate a new key.
• Revoke — click "Revoke" next to an existing key to permanently delete it. Revoked keys immediately stop working.

Security best practices

• Use environment variables — never hardcode API keys in source code or commit them to version control.
• Rotate keys periodically — create a new key and delete the old one on a regular schedule.
• Use separate keys — create different keys for development, staging, and production environments.
• Restrict access — only share keys with team members who need them.

Rate limiting

API keys can have rate limiting enabled with a configurable time window and max request count. When you exceed the limit, the API returns a 429 status code:

{
  "success": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded"
  }
}

The rate limit uses a sliding window — after the configured time window elapses since your last request, the counter resets. If you receive a 429 response, wait before retrying. See Error Codes for retry guidance.

Authentication errors