Skip to main content
All API endpoints require an API key in the Authorization: Bearer header. Create and store the key in the BIZ MORI Dashboard; it is shown only once.

Getting your API key

  1. Sign in to the BIZ MORI Dashboard
  2. Open API Keys
  3. Click Issue New Key
  4. Copy and securely store the key — it is shown only once
Your API key grants access to your account. Keep it out of browser code, repositories, and version control.

Test API keys

Use the automatically issued test API key with the sk_test_ prefix when you need to verify an integration without running the underlying processing services. BIZ MORI issues one test key per account and organization, and you can retrieve it from the Dashboard API Keys page. Test API keys:
  • use the same Authorization: Bearer authentication as live keys;
  • use the same order creation, upload, confirm, and query endpoints as live keys;
  • do not run Anti-AI, watermark, or AI Detection processing;
  • do not call external processing services or consume credits;
  • keep test orders separate from live orders; and
  • do not create downloadable result files.
For persistent test orders, the returned upload URL points to a BIZ MORI test upload route. The server consumes the request stream, records upload completion, and discards the file contents. Anti-AI upload mode and AI Detection still require a confirm call; Watermark Embed and Watermark Extract start after their uploads finish. Test orders move through pending, inProgress, and complete or failed states. You can list, inspect, and aggregate your test orders with the normal order endpoints. A test download returns 404 PROCESSED_FILE_NOT_FOUND because no result file is created. A test API key can manage only test webhook endpoints owned by the same owner; see Test API keys for the complete behavior and examples.

Using your API key

Generate a UUIDv4 for each new logical order. The examples below create one before making the first Anti-AI order.

Idempotency

Use a new UUIDv4 for every new logical order. Anti-AI and AI Detection confirms are separate logical requests, so generate a different UUIDv4 for each confirm. Reuse the previous value only when retrying the same logical request after a network failure. Sending the same key again returns the original order instead of creating a new one.

Rate limits

All requests are subject to a global limit of 1,000 requests per 15 minutes and include standard RateLimit headers. Some endpoints may apply additional endpoint-specific limits. For live order API keys, plan usage quota is separate from the global request limit. When that quota is exhausted and no active credit pack is available, the order API returns HTTP 429 with { "code": "PLAN_LIMIT_EXCEEDED" }. Test API keys bypass the plan usage quota, but not the global request limiter, which runs before API-key authentication.

Live and test API keys

With a live key, uploadUrl is an S3 presigned URL. With a test key, it is an absolute BIZ MORI API URL under https://api.bizmori.com/api/v2/test-uploads/{signedToken}. Both expire one hour after issuance; see Quickstart for upload and refresh behavior, and Webhooks for test-key webhook scope.