Arcads API Key Setup: Credentials, Security, and a First Test
FlowPatchThis checklist covers the smallest safe path from no Arcads API access to one verified, read-only request. It is based on the current Arcads API documentation and is written for teams that will later automate generation from Slack, a form, or another internal tool.
Independent note: FlowPatch is not affiliated with or endorsed by Arcads. Confirm current access, endpoints, and account terms in the official documentation before implementation.
1. Confirm the account can expose API credentials
Arcads documents credential generation under Settings -> Public API. If that section is not available, stop and confirm account access with Arcads rather than scraping browser sessions or reusing a personal login.
2. Generate and capture the secret once
The documented credential pair is a client ID and client secret. The client secret is shown only when generated, so place it directly into an approved server-side secret store. If it is lost, generate a new pair and update the application.
- Do not paste the secret into Slack, a browser form, a ticket, analytics, or source control.
- Use separate credentials for development and production when the account supports that boundary.
- Record an owner and rotation date without recording the secret value.
3. Build the documented Basic authorization value
Arcads documents an Authorization header created by Base64-encoding clientId:clientSecret and prefixing the result with Basic. Encoding is not encryption: the completed header must be treated as a credential and must never appear in logs or client-side code.
4. Start with the read-only product list
Before creating products, folders, scripts, or videos, make the documented GET /v1/products request from the server. A successful authenticated response proves the credential path without creating an asset or consuming generation credits.
Authorization: Basic <base64(clientId:clientSecret)> Accept: application/json
Treat 401 as a credential or header problem, 403 as an access or policy problem, 429 as a signal to back off, and 5xx responses as transient vendor failures. Preserve a safe correlation ID and response status, not the authorization value.
5. Map the write sequence before enabling it
The official guide describes a write path that creates or selects a product, creates a folder, creates a script, starts video generation, and then checks the script videos endpoint for status and a download link. Keep each returned identifier so retries can resume rather than recreating earlier resources.
- POST /v1/products or select an existing product.
- POST /v1/folders under the approved product.
- POST /v1/scripts with the agreed folder, name, text, and video configuration.
- POST /v1/scripts/:scriptId/generate only after approval and validation.
- GET /v1/scripts/:scriptId/videos until a terminal state, using bounded polling.
6. Put a credit gate before generation
Arcads states that generation consumes credits and that requests fail without an active subscription and remaining credits. A production integration should validate required fields, approval state, allowed model or recipe, and duplicate status before calling the generation endpoint.
7. Define the first acceptance tests
- Valid credentials can list products without a write.
- Missing or invalid credentials fail without being logged.
- A missing required field creates no script and consumes no credits.
- Retrying the same approved request creates no duplicate generation.
- Success records the product, folder, script, and result identifiers.
- Quota, timeout, and vendor errors return an actionable state without a secret.
Turn the checklist into a bounded implementation
Use the free Arcads API scope generator to define inputs, approval gates, failure states, and acceptance tests. For a Slack entry point, try the interactive Slack-Arcads simulation or review the $299 fixed-scope Arcads API pilot.