Get started
API Authentication
Authenticate model requests and workspace data access with a Platform API key.
Bearer authentication
Send the key in the Authorization header on every authenticated API request. Do not use a main-site session cookie or a supplier key.
Authorization: Bearer YOUR_PLATFORM_KEYCreate and manage keys
Open API keys in the console, choose the workspace, name the key and select its permissions, models and allowed modes from the list. Select at least one mode, or explicitly allow all models and modes (including future models). Copy the secret when it is created and store it securely. Revoke keys you no longer need. Replacing a key requires updating your application configuration.
Permissions
Keys are restricted to their workspace and configured permissions. New keys authorize only the selected modes. Existing keys retain their original model access, including when disabled and enabled again. Use the documented public model endpoint; internal model IDs are not required. Model access requires a permitted mode; restricted models require the corresponding account access.
| Permission | Use |
|---|---|
| models:generate | Submit allowed models; upload, import and read workspace assets. |
| requests:read | Retrieve task status and results. |
Request example
Read an existing task using a server-side environment variable.
curl "https://platform-backend.topview.ai/api/v1/predictions/TASK_ID" -H "Authorization: Bearer $TOPVIEW_API_PLATFORM_KEY"Authentication errors
Inspect the response error.code and error.message. Changing keys cannot bypass workspace or model restrictions.
| HTTP status | What to check |
|---|---|
| 401 | Missing, invalid, expired or revoked API key. |
| 403 | Required scope, model allowlist or account access is missing. |
| 404 | The requested task or asset is not available in this workspace. |
Protect your key
Keep API keys in server environment variables or a secret manager. Never embed them in browser code, mobile apps, public repositories or URLs. Use separate keys for environments and applications, limit permissions, and revoke exposed keys immediately.