API keys let your code, build scripts and AI coding agents generate sprites with your account. They work with both the REST API and the MCP server.
Who can create keys
API and MCP access is included with every plan, including Free. Calls spend your normal credit balance at the same prices as the website, so a free account can try the API with its daily credits.
Create a key
- Go to Dashboard → API keys.
- Click New key and give it a name that says where it’s used:
ci-asset-build,claude-code-laptop,cursor-work. - Copy the key. It starts with
asm_live_and is shown only once. We store only a SHA-256 hash of it, so we can’t show it to you again.
If you lose a key, revoke it and create a new one.
Store it safely
Put keys in environment variables or a secrets manager, never in source code:
# local shell
export ASM_API_KEY="asm_live_…"Then read it in code:
const key = process.env.ASM_API_KEY;Python reads it the same way:
import os
key = os.environ["ASM_API_KEY"]- Add
.envfiles to.gitignore. - In CI (GitHub Actions, GitLab), store the key as an encrypted secret.
- Don’t ship keys inside a game build, a browser bundle or a mobile app. Anyone can extract them. If players need to generate sprites in your game, call our API from your own server.
One key per place
Use a separate key for each machine, app and environment. If a laptop is lost or a key leaks in a log, you revoke just that one. The API keys page shows each key’s prefix, name, creation date and when it was last used, which makes it easy to spot keys nobody needs.
Rotate or revoke
To rotate a key without downtime: create the new key, deploy it, check that “last used” moves to the new key, then revoke the old one. Revoking takes effect immediately; requests with a revoked key get 401 invalid_api_key.
If you think a key leaked (for example it was pushed to a public repo), revoke it right away, then check your recent jobs for anything you didn’t make and email hello@aispritemaker.com.
Limits
| Limit | Value |
|---|---|
| API requests | 120 per minute per key |
| New jobs | 20 per minute |
| Jobs running at once | Free 1, Starter 2, Pro 4, Studio 10 |
Max frame size (size) | Free 128 px, Starter 256 px, Pro and Studio 512 px |
Going over a limit returns 429 and costs nothing. Retry after a short wait.
Common errors
| Error | Meaning | Fix |
|---|---|---|
401 unauthorized | No Authorization header | Send Authorization: Bearer asm_live_… |
401 invalid_api_key | Key mistyped, revoked, or its account was deleted | Check for missing characters; create a new key |
429 rate_limited | Too many requests per minute | Back off and retry |
429 concurrency_limit | Too many jobs running | Wait for one to finish |
The full list is in the API reference.
Related: REST API · MCP server