Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.babysea.ai/llms.txt

Use this file to discover all available pages before exploring further.

API keys authenticate requests to the BabySea /v1 API. A key belongs to one account, one region, and one set of scopes.

​
Access

RoleCan viewCan createCan rotateCan revoke/delete
primary-ownerYesYesYesYes
ownerYesYesYesYes
memberYesNoNoNo
Members can inspect key metadata but management actions are disabled.

​
Create a key

1

Open API keys

From the dashboard, open API keys for the selected account.
2

Name the key

Use a clear name such as production-worker-us or ci-smoke-tests. Names can be up to 100 characters.
3

Choose scopes

Pick a preset or use custom scope triples.
4

Optional: add expiry and IPs

Set an expiration date or an IP allowlist. If no IPs are set, all client IPs are allowed.
5

Store the key

Copy the full bye_... key before closing the dialog. It cannot be retrieved later.

​
Permission presets

PresetScopesUse case
Full Accessgeneration:write, generation:read, generation:delete, account:read, health:read, library:readAdmin scripts and development.
Generate Onlygeneration:write, generation:read, library:readProduction generation workers.
Read Onlygeneration:read, account:read, health:read, library:readReporting and dashboards.
Monitor Onlyhealth:read, library:readUptime monitors and catalog sync.

​
Scope reference

ScopeRoutes
generation:writePOST /v1/generate/image/{model_identifier}, POST /v1/generate/video/{model_identifier}
generation:readGET /v1/content/{generation_id}, GET /v1/content/list
generation:deleteDELETE /v1/content/{generation_id}, POST /v1/content/generation/cancel/{generation_id}
account:readGET /v1/status, GET /v1/usage, GET /v1/user/account, GET /v1/user/billing
health:readGET /v1/health/inference/providers, GET /v1/health/inference/models, GET /v1/health/storage, GET /v1/health/cache
library:readGET /v1/library/providers, GET /v1/library/models, GET /v1/estimate/{model_identifier}

​
IP allowlists

Use IP allowlists for fixed server workloads or CI runners.
  • Up to 50 entries per key.
  • Each entry can be up to 45 characters.
  • null allowlist means all IPs are allowed.
  • Disallowed clients receive BSE1007 with type ip_not_allowed.

​
Rotate a key

Rotation creates a new key with the same scopes and IP allowlist. The old key stays valid during the grace period.
SettingValue
Default grace period24 hours
Minimum1 hour
Maximum168 hours
1

Rotate in the dashboard

Open the key action menu and choose Rotate.
2

Deploy the new key

Store the new value in your secret manager and deploy it to all consumers.
3

Wait for the grace period

Confirm logs show traffic from the new key prefix.
4

Revoke the old key if needed

Revoke early if you are responding to exposure or no longer need the overlap.

​
Revoke vs delete

ActionEffectUse it when
RevokeSets the key inactive. Metadata remains for audit.You want to stop access but keep history visible.
DeletePermanently deletes the key row and cascades key logs.You no longer need the key or its logs.

​
What is logged

Every API request records key usage metadata:
  • key prefix
  • endpoint and method
  • status code
  • error code
  • idempotency replay flag
  • sanitized query parameters
  • SHA-256 IP hash
  • user agent
  • timestamp
View these records in logs.