Authenticate

Create an account

Both answer a session token and set it as an httpOnly cookie. A session token lasts 7 days and is what the console uses; it is not an API key. Google sign-in isn't available yet. Where a deployment enables it, it starts at GET /v1/auth/google/start.

curl -X POST https://dueta.ai/v1/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "a-strong-password"}'
# -> {"access_token": "eyJ...", "token_type": "bearer"}
# Already registered? POST /v1/auth/login with the same body.

Create an API key

Session token only. The response is the only one that carries the full key; every later read returns the prefix and nothing more. Keys do not expire. The console's API keys page does the same thing with a click.

curl -X POST https://dueta.ai/v1/keys \
  -H "Authorization: Bearer eyJ..." \
  -H "Content-Type: application/json" \
  -d '{"name": "production-server"}'
# -> {"id": "...", "name": "production-server", "prefix": "mk_live_8fQ2",
#     "key": "mk_live_8fQ2...", "created_at": "..."}   <- full secret, shown once

export DUETA_API_KEY="mk_live_8fQ2..."

Call with a key

Send Authorization: Bearer <key> on every request. Uploads, jobs, results, shares, credits and billing all accept a key. The routes below take a session token only, so a leaked key cannot mint its own replacement or change the password.

curl https://dueta.ai/v1/credits \
  -H "Authorization: Bearer $DUETA_API_KEY"
# -> {"balance_usd": 20.0, "ledger": [...]}

Rotate or revoke

Rotation keeps the id and the name and replaces the secret in place; the old secret stops working the instant the new one is returned, with no overlap. Revoking answers 204 and is idempotent. List keys with GET /v1/keys.

# Replace the secret in place. The old one stops working at once.
curl -X POST https://dueta.ai/v1/keys/$KEY_ID/rotate \
  -H "Authorization: Bearer eyJ..."
# -> {"id": "$KEY_ID", "prefix": "mk_live_c71d", "key": "mk_live_c71d...", ...}

# Revoke. 204, and a second DELETE is also 204.
curl -X DELETE https://dueta.ai/v1/keys/$KEY_ID \
  -H "Authorization: Bearer eyJ..."

Cases

401

Wrong password, no credential, a revoked key, or a key rotated away.

403

The account is disabled. No request succeeds until support re-enables it.

409 signup

The email is registered, or it is a Google-only account: sign in with Google, or set a password from Settings.

409 jobs

On a deployment that requires verification, an unverified password account can log in but gets 409 on job submission until the emailed link is clicked. POST /v1/auth/verify/resend sends it again; the link lasts 24 hours.

409 rotate

The key is already revoked. Create a new one.

Reset

POST /v1/auth/password/forgot answers 202 whether or not the address exists. POST /v1/auth/password/reset with the emailed token is 204, or 400 once the link is used or expired. 503 where reset is not enabled.

501

Google sign-in isn't available yet. The route answers 501 until a deployment configures it.

502

The verification or reset email could not be sent. The account exists; try again shortly.

Rate limit

Signup 5 a minute and login 10 a minute, per IP. See Errors & limits.

Logout

POST /v1/auth/logout clears the cookie and is deliberately unauthenticated, so an expired session can still be cleared. All auth routes.