Promoat.Start here
Authentication
One bearer token on every request. Keys are issued in the partner dashboard and scoped to your account — everything you create belongs to you alone.
The header
Every endpoint under /api/partner/v1/ requires an Authorization header with your full key:
Authorization: Bearer pmat_1a2b3c4d5e6f_9f8e7d6c…Keys look like pmat_<key id>_<secret>. The whole string is the credential — send it exactly as issued. There are no cookies, signatures, or timestamps involved.
Getting your key
Keys are minted in the partner dashboard, where you can also reveal and copy the current key (signed-in only). Rotation is not self-serve for current keys: if you suspect a leak, ask Promoat support to replace the key, then update your secrets manager. The dashboard's Replace with new encrypted key button appears only for older keys stored without an encrypted copy; replacing kills the old key immediately.
Call the API from your backend, never from your users' browsers or mobile apps — anyone holding the key can spend your credits. (The “Try it” boxes in these docs run from your browser as a convenience for testing; that's you spending your own credits, not a pattern to ship.)
What failures look like
A missing or unrecognized key returns 401 with a JSON error:
{ "error": "Missing Authorization Bearer token" }
// or
{ "error": "Unauthorized" }Two things worth knowing about how authorization behaves across the API:
- Ownership is absolute. Characters, voices, assets, and jobs are scoped to the key's account. You can never see or use another client's resources.
- Existence is never leaked. Requesting a resource that belongs to someone else returns the same
404as one that doesn't exist at all.
Connectors
ChatGPT and similar connectors use this site's /mcp URL. The first call has no API key, so the server starts a browser connect flow: you sign in with your partner account and approve the app. That app then calls the same URL with its own access token, billed to your account. It never receives your pmat_ key.
Coding agents keep sending Authorization: Bearer pmat_… on that same URL. A key does not open the browser flow.
Check your key
The cheapest sanity check is GET /usage/summary — free, instant, and returns your balance. The sidebar's Test key button does exactly this, or run it here: