Use the Developer API and webhooks

The API page in Dashboard is for programmatic access to avatars, voices, audio, and video generation. Open Dashboard → API to see the current base URL, authentication format, API-key management, webhook settings, and a link to the full developer reference.

Who can create an API key

Developer API access is available to paid plans. If the API key card shows a plan-required message, upgrade through Billing before trying to create a key. Keep API access separate from ordinary dashboard sign-in: an API key is a secret credential for software, not a password to share with a person.

Create and store an API key

1. Open Dashboard → API and find the Developer API card.

2. Enter a recognizable key name, such as “production backend” or “staging integration”, then select Create.

3. Copy the complete key immediately and store it in your deployment's secret manager or protected environment configuration.

4. After you close the one-time reveal, the dashboard retains only a prefix and usage metadata. The full key cannot be viewed again.

Treat an API key like a password with the ability to spend account credits. Never put it in browser code, a mobile app, screenshots, chat messages, public repositories, or client-side environment variables.

Authenticate a request

The API page shows the current base URL and the Authorization header format. Send the API key from trusted server-side code using Authorization: Bearer <key>. Consult the developer reference for endpoints, request bodies, task polling, response shapes, rate limits, and current error codes before building an integration.

Rotate or revoke a key

1. Create and deploy a replacement key first when you can do so safely.

2. Update every service that uses the old key and confirm its requests are succeeding.

3. Use the revoke action beside the old key in Dashboard → API.

Revocation is irreversible. Do not revoke a key merely because you want to see its full value again; create a replacement instead.

Configure a generation webhook

1. In Dashboard → API, enter a public HTTPS endpoint that your server controls in the Webhook card.

2. Select Save. Saving a new or changed endpoint can reveal a webhook secret once; copy and store it immediately.

3. On your server, calculate HMAC-SHA256 over the raw request body using that secret and compare it with the X-Odrazio-Signature header before accepting the event.

4. Use the event to trigger a server-side fetch of the corresponding resource or update your job record. Do not treat an unverified incoming request as proof of a completed generation.

Changing or removing a webhook

Saving a changed webhook URL can rotate the secret, so update your verification configuration at the same time. Use Remove when you no longer want delivery. A valid URL must be publicly reachable over HTTPS; a local-only development address cannot receive platform callbacks.