Authentication
Use Seeddance API keys without exposing them to clients or logs.
Include a Seeddance API key in the HTTP Bearer header of every /v1 request.
Authorization: Bearer sk_sd_exampleCreate a key
Open Settings → API keys, give the key a recognizable name, and create it. You can view the full secret only once. After that, Seeddance keeps only a secure hash and cannot recover the secret.
Keep keys on the server
Never expose an API key in client code
Do not put API keys in browser JavaScript, mobile app bundles, local storage, or public repositories. Send requests from a server you control and load the key from a secret manager or environment variable.
Store the value as SEEDDANCE_API_KEY and inject it only into the server process that calls the API. Do not print it in application logs or error trackers.
Revoke and rotate
If a key may have leaked, revoke it immediately. Requests that use a revoked key return 401 invalid_api_key. To keep requests running during rotation, create the replacement before you revoke the old key.
Rate limits
Each API key allows up to 120 requests per minute. If you exceed the limit, the API returns 429 rate_limit_exceeded. Retry with exponential backoff and jitter. Task polling counts toward the limit, so start with a 5 to 10 second polling interval.