Keys and spending
Set render approvals, temporary budgets, and credit caps for external agents.
API keys belong to a workspace and spend its credits. Owners and admins can create, edit, and revoke keys in Settings → API keys.
A key is shown once when you create it. Sundream stores its hash, so a lost key must be revoked and replaced.
Estimate the work
estimateCost returns a credit estimate without starting a generation. With
a projectId and no specific work list, it estimates the missing references,
frames, and clips needed for that project.
Ask your agent to show the estimate before approving work. The total can change if you choose different models, change settings, or generate more takes.
Choose a render-approval mode
| Mode | What happens when a render is requested |
|---|---|
| Confirm each render | The tool returns a quote. The agent calls approveRender with that quote's token to start the render. |
| Auto-approve | The render starts if it fits the key's cap and the workspace's limits. |
A quote token can be used once and expires after ten minutes. If the quoted cost increases before approval, the tool returns a new quote. You can change a key's approval mode without replacing the key.
The agent submits these approvals through the API. Sundream does not show you a separate confirmation dialog for them, so tell your agent when it should ask you before approving a render or budget.
Approve a temporary budget
For a group of renders, the agent can call approveSpend with a credit amount.
That budget allows renders without individual quotes until it is used up or
expires, after 60 minutes by default.
A budget belongs to the key and can cover work across its projects. A new
budget replaces the previous one. Calling approveSpend with zero credits
cancels the remaining budget.
The key's rolling cap and the workspace's balance, daily spending limit, and queue limits still apply. A temporary budget doesn't raise those limits.
Set a spending cap
A key's optional cap limits credits spent over a rolling 24 hours. A render that would exceed it is refused. Settings → API keys shows each key's usage against its cap.
Use separate keys for separate clients or automated tasks so you can track usage and revoke one connection without interrupting the others.
Revoke or replace a key
Revoke a key in Settings → API keys if you no longer use it or think it has been exposed. Cached authorizations can take up to 30 seconds to expire. A key also stops working when its creator no longer belongs to the workspace.
Store keys in your client's secret settings or pass SUNDREAM_API_KEY through
its environment. Don't put a real key in source code or a shared config file.