API Keys & Permissions

An API key lets a script, a server or an AI agent call the VULK API on your account. Keys are included in every plan — Builder, Pro, Max, Team, Business and Enterprise — and are managed in Settings › API keys at app.vulk.dev/settings?tab=ApiKeys.

Creating a key

1. Open Settings › API keys.
2. Under New key, give the key a name — where it will be used, for example CI deploys or Zapier.
3. Choose its permissions. Reading is selected by default; Create, continue, stop and delete projects is opt-in.
4. Choose Create key.
5. Copy the key now. It starts with vk_sk_ and is shown only this once: VULK keeps a fingerprint of it, not the key itself. Choose I have saved it when it is stored.

The list then shows the key by its name, with its creation date, when it was last used, its request limit and its permissions. An account may hold up to 20 keys.

Permissions

Each key carries one or more scopes. An endpoint checks the one scope it needs, and a key without it is answered with 403:

{ "error": "This API key was not granted the projects.write scope. Create a key with it in Settings › API keys.", "code": "FORBIDDEN", "status": 403 }

Scopes are fixed when the key is created. To change what an integration may do, create a key with the right scopes and revoke the old one.

Building (projects.write) spends the credits of your plan, exactly as the same brief typed into the editor would. Reading never does.

Rate limit

Each key may make 60 requests per minute. Every authenticated answer reports where the key stands:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1760360400

Past the limit the API answers 429 with Retry-After. The limit is per key, so an integration that needs more room can be split across keys.

Revoking a key

In Settings › API keys, choose Revoke on the key. Revocation is immediate: the next request with that key is answered 401 Invalid, expired or revoked API key. Nothing else changes — projects the key created stay in your account.

Keys from the previous VULK

A key created in the previous VULK workspace at vulk.dev also works on https://app.vulk.dev/api/v1. It appears in Settings › API keys with the note Created in the previous VULK. It works the same and can be revoked here, and its permissions are mapped to the scopes above:

Any other previous permission grants no scope here. A key with an expiry date keeps it. The reverse does not hold: a key created at app.vulk.dev is for app.vulk.dev/api/v1 only, and is not known to the previous API or to the vulk-mcp-server npm package. Revoking such a key in Settings › API keys stops it on app.vulk.dev/api/v1; to stop it on the previous API at vulk.dev/api/v1 as well, delete it in the previous workspace.

Keeping keys safe

• One key per integration or environment, named after it.
• Only the scopes it needs; most tools only read.
• Keys live in environment variables or a secret store, never in version control and never in browser code.
• Revoke a key the moment it may have leaked.

Models

Generations run on VULK's own model accounts and are paid with the credits of your plan — there is nothing to configure. GET /models lists the models your account may generate with and what each costs.