API keys and workspaces
Send a bearer credential with protected REST requests: an API key for a backend or script, or browser login for the Masko CLI (masko login).
Create an API key
Create a key in API keys for your workspace. Write access can generate and edit; read allows GET only.
Keys look like masko_{64-hex-characters} and are shown once (Masko keeps a SHA-256 hash). Save yours as MASKO_API_KEY in your server environment or secret manager.
Check your key
A balance request is free:
curl https://api.masko.ai/v1/credits \
-H "Authorization: Bearer $MASKO_API_KEY"Personal and organization keys
- Personal keys use personal projects and credits.
- Organization keys use team projects and the team's credits. Team owners and admins create them; project restrictions still apply.
Switch workspace in the dashboard before creating a key; a resource in another workspace returns 404, even if you belong to both. Unattached uploads, user templates and webhooks stay account-owned, while source assets attached to a mascot must pass its workspace checks.
Keys in shipped apps and websites
Keep the key on your server, never in browser JavaScript, a shipped app or a public repository. Public files use hosted CDN URLs; for a private canvas release, your backend fetches its signed delivery and passes only that to the client (deliver a release).
Error codes
Missing or invalid credentials return 401, insufficient permissions 403, inaccessible resources 404, and rate limits 429. See errors and recovery for backoff and safe retries, then continue with the quickstart.
