Authentication

Every request carries your API key. Get it from your dashboard at imentiv.ai/my-profile.

REST — a header

X-API-Key: your_api_key

Send the key exactly as the dashboard shows it. No prefix, no Bearer, no encoding.

curl https://devapi.imentiv.ai/v2/videos/abc123 \
  -H "X-API-Key: your_api_key"

Browsers cannot set headers when opening a WebSocket, so the results socket accepts the key in the URL instead:

wss://devapi.imentiv.ai/v2/ws/realtime?token=your_api_key&session_id=...

The credential is checked exactly as it is on the REST path. What differs is only how it travels — and travelling in a URL has a cost.

A key in a URL is an exposed key

URLs land in proxy logs, browser history, server access logs and error reports. Treat a key used from a browser as exposed:

Issue a separate key per environment, so revoking one costs you one environment.
Rotate it if you have any reason to think it leaked.
Prefer keeping the socket server-side. If your backend holds the Imentiv connection and relays results to your own clients, your key never reaches a browser at all. Where you can set headers, send X-API-Key instead of ?token=.

Response	Meaning
`401`	Missing or invalid key. Check the header name and that the key is sent verbatim.
`402`	The key is valid; the account is out of credit. Retrying will not help.
WebSocket closes with `1008`	Authentication failed, `session_id` was missing, or credit was too low. The close reason says which.