Client and secret API keys, and the API reference

Studio's API Keys page now creates two kinds of key:

• Client keys (rv_client_) go inside your app, for example as Viro's rvApiKey. Each one is bound to one project.
• Secret keys (rv_secret_) stay on your own backend. Only a secret key can generate with AI, read or delete app users' files, and mint user tokens. Never put a secret key in an app you publish.

The ReactVision API now has a public reference at /reference. Authentication explains which key goes where, with guides for client keys and secret keys.

Existing keys are now legacy keys. They keep working, with these changes from today:

1. AI generation (ai-images and ai-models) needs a secret key. A legacy key is refused with 403 API_KEY_TYPE_NOT_ALLOWED.
2. Listing, fetching and deleting app users' files (GET /assets/list, GET /assets/{asset_id}, DELETE /assets/{asset_id}) needs a secret key, with the same 403.
3. An anchor, scene, project, function or file of another team answers exactly like one that does not exist: 404 with the resource's not-found code when its id is in the path, and 403 PROJECT_NOT_FOUND for a project_id in the query or the body. See Errors.
4. Anchor searches will be capped at 100 results within 5,000 m.
5. Rate limits will apply. See Limits.

Changes 4 and 5 are not enforced yet. A later entry here gives the date.

Next, ReactVision converts legacy keys. A key that an app uses on one project becomes a client key of that project and keeps its string, so the app needs no rebuild. We email each key's owner before anything changes, with the date that applies to that key.