Keys, scopes and environments
Keys live in projects, work in one environment, and can do only what their scopes allow. Owners, admins and developers manage them in the dashboard; viewers can see them.
Test and live
| Test | Live | |
|---|---|---|
| Key prefix | sk_test_ | sk_live_ |
| Signing certificate | Our test chain | Our live chain |
| Monthly allowance | Its own: 100 marks on Free, as many as live on paid plans | Your plan's |
| Use for | Development, CI, trying options | Files you publish |
Both environments run the same code and the same checks. Files marked with a test key are really marked, but signed with the test chain, so a checker tells them apart.
Scopes
Give each key the fewest scopes it needs. Scopes for endpoints still to come can already be set.
| Scope | Allows | Available |
|---|---|---|
mark | POST /v1/mark: marking files in the cloud | Now |
tsa | POST /v1/tsa/{key}: time-stamps for local mode. Alone on its key, the only kind of key allowed in a URL | Now |
sign | POST /v1/sign: local mode's signature, for the SDK and the ComfyUI nodes | Now |
check | POST /v1/check: the safety check of a picture. The check option of POST /v1/mark needs only mark | Now |
verify | Nothing yet: POST /v1/verify and its signed results need no key | Reserved |
GET /v1/usage works with any valid key.
Projects
Projects group keys, for example per app or per customer. Every organisation starts with a Default project. Deleting a project revokes its keys at once; its usage history stays.
IP allowlists
A key can be limited to IPv4 and IPv6 ranges in CIDR notation, such as 203.0.113.0/24 or 2001:db8::/32. A single address is the same as a /32 or /128. Up to 100 ranges per key; an empty list allows any address. Requests from elsewhere get 403 ip_not_allowed.
- We match the address your request reaches our edge from: behind NAT or a proxy, that's its public egress address.
- An IPv4 address that arrives as IPv6 (
::ffff:192.0.2.1) matches IPv4 ranges. - Ranges are stored in canonical form: host bits are cleared, so
10.1.2.3/8becomes10.0.0.0/8. - Every change to a key's allowlist is recorded in the audit log, with the list before and after.
Creating and revoking
- Creating keys needs a confirmed email address.
- The key is shown once, when created. We keep only its SHA-256, its first characters and its last four.
- The dashboard shows when each key was last used (updated at most once a minute).
- Revoking is immediate and can't be undone.