Pureframe AI API Documentation

API keys authenticate requests to the Pureframe AI API. Each key is scoped to a permission level and can be revoked independently without affecting your other keys.

Create, list, and revoke keys from Settings → API Keys in the dashboard, not through the API. The endpoints below require a signed-in web session and admin role: they cannot be called with an API key, by design, so there’s no programmatic key-management flow to integrate against. This page documents what those endpoints do, not a recommended integration path.

Why key management is dashboard-only

An API key can authenticate search, upload, and collection requests, but it can never create, list, or revoke another key, including its own. Key creation and revocation require a web session token (the one your browser holds after you sign in), specifically so a leaked API key can’t be used to mint new keys or revoke the legitimate ones on the account. There’s no way around this from server-to-server code; if you need a new key, someone has to generate it from the dashboard.

What happens when you create a key

curl -X POST https://api.pureframe.ai/v1/api_keys \
  -H "Authorization: Bearer <session-token>" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Production server", "permissions": "all" }'

{
  "data": {
    "id": "a1b2c3d4-...",
    "user_id": "usr_...",
    "name": "Production server",
    "prefix": "pf_a1b2c3d4",
    "permissions": "all",
    "created_at": "2026-07-01T12:00:00Z",
    "key": "pf_a1b2c3d4e5f6..."
  }
}

The key field contains the secret used in the Authorization header. It is only returned in this response. Store it immediately; there’s no way to retrieve it again. If you lose it, revoke the key and create a new one.

Permission levels

Level	Access
`all`	Full read and write: upload, search, manage collections and webhooks
`read_only`	Search and list operations only; excludes uploads, deletes, and webhook management

Use read_only keys for trusted agent or server integrations that do not need write access. Do not expose an API key in browser code or other untrusted clients. See MCP overview.

Listing and revoking

Listing returns every key on the account, including revoked ones: the plain secret is never included, only prefix (the first 12 characters), so you can tell which key is which. Revocation is immediate and permanent; a revoked key can’t be reactivated.

curl https://api.pureframe.ai/v1/api_keys -H "Authorization: Bearer <session-token>"

curl -X DELETE https://api.pureframe.ai/v1/api_keys/a1b2c3d4-... \
  -H "Authorization: Bearer <session-token>"

Plan limits

Plan	Max active keys
Free	1
Pay as you go	20
Enterprise	Unlimited

Creating a key beyond your plan’s limit returns 402 with code API_KEY_LIMIT_REACHED. See Errors.

API key object

Field	Type	Description
`id`	string	Unique key ID
`user_id`	string	Owning account ID
`name`	string	Display name you chose at creation
`prefix`	string	First 12 characters of the key, for identification in lists
`permissions`	string	`all` or `read_only`
`last_used_at`	string \| null	ISO 8601 timestamp of the most recent authenticated request, or `null` if never used
`created_at`	string	ISO 8601 creation timestamp
`revoked_at`	string \| null	ISO 8601 timestamp if revoked, else `null`

Security guidance

Store keys in environment variables or a secrets manager.
Do not place keys in client-side code, prompts, logs, or source control.
Use a separate key for each integration so you can revoke access independently.
Key creation and revocation require an authenticated dashboard session with the appropriate role.

Get Started

Search

Video Processing

Agents

Production

Resources

API Keys

Why key management is dashboard-only

What happens when you create a key

Permission levels

Listing and revoking

Plan limits

API key object

Security guidance

​Why key management is dashboard-only

​What happens when you create a key

​Permission levels

​Listing and revoking

​Plan limits

​API key object

​Security guidance

Why key management is dashboard-only

What happens when you create a key

Permission levels

Listing and revoking

Plan limits

API key object

Security guidance