Authentication

All Edit Square endpoints are authenticated using API keys as a bearer token:

curl --request GET \
  --url 'https://api.editsquare.com/v1/renders?project_id=proj_j123456789' \
  --header 'Authorization: Bearer <key>'

const url = 'https://api.editsquare.com/v1/renders?project_id=proj_j123456789';
const options = {
  method: 'GET',
  headers: { Authorization: 'Bearer <key>' },
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

Full request and response documentation can be found in the renders api reference section.

Any request with no Authorization header will be rejected with 401. See authentication errors for the other ways a key can be refused.

Getting a key

Keys are created in the dashboard:

Open the dashboard and click your avatar in the bottom-left.
Choose Account Settings.
Open the API Keys tab.
Create a key and give it a name you will recognise later.

The same tab lists your keys and is where you revoke one.

What a key can reach

A key belongs to the person who created it and carries that person’s access: it can do whatever they can do, across every account and team they belong to, and nothing else.

GET /v1/me answers which user a key acts as, which is the quickest way to tell two keys apart when a request is not returning what you expected.

That makes revocation the tool for everything: someone leaves, a key leaks, a script is retired - revoke that key and create a new one.

Keeping keys safe

Treat a key like a password: server-side only, out of git, out of the browser. Anyone holding it can render against your teams’ projects and spend their credits.
Give each integration its own named key, so one can be revoked without stopping the others.
Revoking is permanent, and takes effect shortly after.