Authentication
bm_live_ and bm_test_ keys, permissions and best practices for using the API.
The API lets your system generate banners without opening the application. It is JSON over HTTPS and everything hangs from https://app.bannermotion.com/api/v1. Every request carries an API key.
ملاحظة.
https://app.bannermotion.com is the address our SDKs and the Figma plugin use. [PLACEHOLDER: confirm the final API domain]API keys
In the side menu, go to Integrations & API and click Create API key (only the Owner and Admin members can). Give it a name, choose the environment and the permissions, and send the key in every request:
Authorization: Bearer bm_live_<your-key>EnvironmentWhat it does
bm_live_… (Production)Generates for real and uses credits according to the model and what you ask for: a concept with 1 size and 1 locale costs
10 credits with Sonnet 5.5, and it goes up with the sizes and locales in the request.bm_test_… (Testing)Uses no credits, no AI and writes nothing: it always returns the same sample concept for the same request. Useful for testing your integration. It does not work with the MCP server.
Permissions
When you create the key, you choose what it can do; the names in parentheses are the ones used in the application. Without the permission, the API responds 403. Every permission includes reading.
PermissionAllows
generate(Generate banners) Create concepts (
POST /api/v1/banners), correct them, add sizes and locales, and archive campaigns. Includes reading.read(Read banners and statuses) Query concepts, jobs, campaigns and the library, and estimate credits.
export(Export packages) Create, query and download exports (
/api/v1/exports). Includes reading.assets(Manage the library) Upload and remove library files (
POST and DELETE on /api/v1/assets). Includes reading.تنبيه. The key value is only shown when you create it. If you lose it, revoke it and create another one: a revoked key responds
401. Use it only from your server, never in code that runs in your visitors' browsers.ملاحظة. The API accepts the key only in
Authorization: Bearer, never cookies, and answers with open CORS (Access-Control-Allow-Origin: *) so a plugin's interface can call it. That does not change the rule above: the key does not belong in public code.ملاحظة. If the Owner's email is not verified yet, anything that spends credits responds
403 with the code email_unverified.ملاحظة. The API is available on the Team, Agency and Enterprise plans.
Errors and limitsThe error format, each status code, and the requests-per-minute limit.Create a bannerCreates a concept in all the sizes and locales you ask for. Responds 202 with a job; check its status or wait for the webhook.SDKs and OpenAPITypeScript and Python clients, the OpenAPI 3.1 specification and the API's llms.txt.
هل كانت هذه الصفحة مفيدة؟