Developer
Create and revoke keys for the public API.
Manage endpoints, rotate signing secrets, and inspect deliveries.
Credits spent per model, and your current balance.
Current per-model credit prices.
Interactive documentation for the public API.
Verifying webhook signatures
The X-GenStudio-Signature header may carry MORE THAN ONE v1 value. During the 24-hour secret rotation grace window it carries two — one signed with the new secret, one with the previous. Try each in turn and accept the request if ANY of them matches. Implementations that read a single v1 will reject every delivery during a rotation.
Reject requests whose t differs from your current time by more than 5 minutes. The signed payload is "{t}.{rawBody}" — the timestamp is inside the signature, so it cannot be changed without invalidating it.
X-GenStudio-Signature: t=1785000000,v1=<hex>,v1=<hex>
X-GenStudio-Event: generation.succeeded
X-GenStudio-Delivery: <delivery id>
X-GenStudio-Event-Version: 1Rotating your signing secret
POST /api/v1/me/webhook-endpoints/{id}/rotate-secret returns the new secret once. The previous secret keeps working for a grace window so you can deploy without dropping deliveries; the response tells you exactly how long.
Rotating twice within the grace window invalidates the OLDEST secret immediately. The endpoint keeps exactly one previous secret, so a second rotation overwrites it. Finish deploying one rotation before starting the next.
Endpoint requirements
Webhook URLs must use https on port 443. If you self-host on another port, terminate TLS behind a reverse proxy on 443, or use a tunnel such as ngrok or Cloudflare Tunnel — both terminate on 443, so local development works unchanged.
Rotating a secret and re-triggering verification are available in the web app only. Both require re-entering your password, and an API key has no password context. This is a deliberate MVP scope decision, not a missing endpoint.
Retries and de-duplication
A single event is delivered at most 9 times, spread over at least 31 hours. Size your de-duplication window accordingly: the same X-GenStudio-Delivery id may arrive more than once during that period.
De-duplicate on X-GenStudio-Delivery, not on the payload. The delivery id is stable across every retry of the same event; the signature is not (each attempt is signed with a fresh timestamp).
Return any 2xx to acknowledge. Anything else — including a slow response body — counts as a failed attempt and is retried. After the last attempt the delivery is marked dead and you can replay it from the delivery log.
Error codes
asset_lost— 410download_timeout— 504endpoint_not_verified— 409forbidden— 403idempotency_key_reuse— 422insufficient_credits— 402insufficient_credits_on_fallback— 402internal_error— 500invalid_credentials— 401invalid_params— 422invalid_state— 422invite_invalid— 422job_stalled— 500job_stuck— 500maintenance— 503not_found— 404provider_auth_failed— 500rate_limited— 429reauth_required— 401submit_unknown— 500unauthorized— 401upload_too_large— 413upstream_error— 502upstream_rate_limited— 502upstream_rejected— 502upstream_timeout— 504upstream_unavailable— 502verification_failed— 422