The Request Is Signed Before It Is Sent

The call is signed before it is sent. That order is the whole security model, and it is a few lines of arithmetic. The nonce is a unix second, and a unix second in 2026 is a 10 digit integer that changes on every request. The message is the API secret concatenated with the nonce, with no separator between the 2. The signature is HMAC-SHA256 keyed on the API key, returned as a hex digest. 3 of those values travel as headers: the key, the nonce and the signature. A content type and a browser User-Agent ride along with them. The secret is not the signer. The key signs, and the secret is the message the key signs. Swap the 2 and every call fails, which is the useful part. A signing error is loud and it arrives before any work is done.

The API sits behind Cloudflare, and Cloudflare reads a header before the model ever reads a body. A bare urllib User-Agent or a bare curl User-Agent answers HTTP 403 with error code 1010. That is a bot block. It fires at the edge, and the request is discarded rather than queued. The shape of the failure is what costs the time. HTTP 403 with an error code reads like a credential problem, and the credentials are correct. An afternoon lost to an auth error that was never an auth error is the normal price of dropping 1 header. The probability that a call assembled from remembered signature headers and no browser User-Agent returns a result sits near 1 in 20, against near 19 in 20 for the same call built from the reference. So the reference carries 5 headers, and the boring one among them is load bearing.

Submitting is Run: 1 POST to the model path on the API host. Polling is Task Detail, and the body is either the task id or the socket access token that came back with it. Stopping is Task Kill or Task Cancel, which are 2 different calls rather than 1 call with a flag. The submit answer carries 4 things: an errors list, a task id, a socket access token and a result flag. The poll answer carries the status, the elapsed seconds, the total cost and the output URL on 1 row. The output URL sits 4 levels deep, under the first task and its first output. It is worth reading twice before writing a download path against it. 4 endpoints, no client library required. A short script covers submit, poll, download and stop, and that script is the whole integration.

1 model renders stills at 1k and 2k, up to 10 reference images on a request, and 1 image per request. The other renders video from 4 to 30 seconds at 480p or 720p, with optional synced audio and a first frame that steers the shot. The operator rule sits above both: generate the images before the video. Locking the character as stills first and animating second is the difference between 1 person and 2 people who resemble each other. The defaults are where the quiet failures live. The aspect ratio defaults to 1:1, the resolution defaults to 1k, and the watermark defaults to off. A 1:1 still at 2k is the wrong input for a 16:9 video, and nothing in the response says so. Setting both explicitly costs 2 fields. Discovering the mismatch costs a full render pass.

The request is signed before it is sent. That order is the whole security model.

The prompt is the only text input on the whole API. There is no negative field to fill. So the negative is appended to the tail of the prompt, and it is copied rather than remembered. 2 tiers exist. The global tier goes on every render and names the render failures: plastic skin, waxy skin, CGI, 3D render, extra fingers, fused fingers, deformed hands, identity drift, text, watermark. The body tier goes on every explicit shot and names anatomy: proportions, symmetry, fused digits, distorted torso, double image. The reference client takes a negative argument on the image and video parameters, holds the 2 tiers as constants, and appends them as a trailing avoid block. A remembered negative is a softened 1. The blocks that hold are the blocks that were pasted.

The account carries 1 concurrent task, and a second submit while 1 is running answers with code 96 rather than a queue position. That is a scheduling fact rather than a rate limit, and it sets the order of work: the stills run first because the video depends on them. The balance at the time of writing was $6.52, which is the number that decides how many passes a shot gets. A run moves through 9 statuses, 2 of them terminal. task_postprocess_end is done. task_cancel is cancelled. Polling past either terminal state is a loop with no exit, and it reads as patience rather than as a bug. A reference image takes a public URL or a provider file id. A local path is not a remote input, and the failure looks like a bad file rather than a bad address. The same rule holds outside the API. The step that is written down survives a change of hand. Companies built across 12 countries, a EUR 75 million industrial group restructured, 210 energy systems across Africa and Asia and 200 wood-gasification machines across the UK and Europe all run on the written version instead of the remembered 1.