Authentication

Overview

The Sora 2 Video API uses API keys for authentication. All API requests must include your API key in the Authorization header using the Bearer token format.

Getting an API Key

1. Sign in to your account
2. Navigate to Settings → API Keys
3. Click "Create New Key"
4. Enter a name for your key (e.g., "Production Server", "Development")
5. Copy and save your API key immediately

Using Your API Key

Include your API key in the Authorization header of every request:

Authorization: Bearer sk_your_api_key_here

Example Request

curl -X POST https://soravideo.art/api/v1/sora2/text-to-video \
  -H "Authorization: Bearer sk_live_abc123xyz789" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "A beautiful sunset over the ocean"}'

API Key Format

API keys follow this format:

sk_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

• Prefix: sk_ (32 random characters follow)
• Length: 35 characters total
• Visible prefix: Only the first 7 characters (sk_xxxx) are shown in the dashboard

Security Best Practices

// ❌ Never do this in frontend code
const response = await fetch('/api/v1/sora2/text-to-video', {
  headers: {
    'Authorization': 'Bearer sk_live_abc123' // Exposed to users!
  }
});

// ✅ Use in server-side code (Node.js, Python, etc.)
// Or proxy through your own backend
const response = await fetch('https://api.example.com/generate', {
  headers: {
    'Authorization': `Bearer ${process.env.SORA_API_KEY}`
  }
});

SORA_API_KEY=sk_live_your_api_key_here

const apiKey = process.env.SORA_API_KEY;

Managing API Keys

Viewing Keys

On the API Keys page, you can see:

• Key name and prefix
• Credit balance
• Status (active/revoked)
• Total requests made
• Last usage time

Revoking Keys

If you suspect a key has been compromised:

1. Go to Settings → API Keys
2. Find the key and click "Revoke"
3. The key will immediately stop working
4. Create a new key for your application

Deleting Keys

To permanently remove a key:

1. Go to Settings → API Keys
2. Find the key and click "Delete"
3. Confirm the deletion

Authentication Errors

Error Response Example

{
  "code": 1001,
  "msg": "Invalid API key"
}

Next Steps