Authentication
Create and use Bearer API keys safely.
Send the Key in one header:
Authorization: Bearer sd_live_...Create a live Key in Settings → API Keys. Self-service Keys expire after 90 days, can be revoked immediately, enable real-person mode only for supported Seedance image-to-video and multimodal requests with rights confirmation and a non-personal audit reference, and store only an HMAC digest in the API control KV. They are separate from legacy sk-... records and do not require a new database table.
Available scopes are models:read, credits:read, generations:read, and generations:write. A Key may also restrict model IDs, requests per minute/day, and concurrent generations. Real-person mode is a per-request choice, not a Key-level permission.
Never place a Key in a query string, request body, prompt, browser, mobile binary, log, error tracker, Git repository, or exported n8n workflow. Store it in a server secret manager or n8n Credential. Revoke a Key immediately from Settings → API Keys if it is exposed.