Implementation Guide

AI API integration: authentication, tasks, and recovery

A practical guide to server-side API keys, idempotent task creation, completion handling, and resource storage.

Use the quickstart for your first request, then add the recovery and authorization rules your production application needs.

Keep credentials and spending controls on your server

Your frontend should authenticate to your application, which authorizes the user before calling OmnAPI. Never put a real account key in browser code, a public repository, or an analytics event. Apply per-user limits and validate all input fields on the server. Review the current operation price before creating paid work.

Treat acceptance and completion as different events

A successful create response means the task was accepted; it does not mean the asset is ready. Save taskId and its ownership immediately. Reuse the same idempotency key on retries of the same logical request. Handle COMPLETED, FAILED, and CANCELLED explicitly, and do not retry a rejected payload unchanged.

Make delivery and recovery part of the contract

Bound polling, back off on rate limits, and keep a task ID so work can resume after your polling deadline. For webhooks, validate the documented signature and process duplicate events idempotently. Store required output files before expiry, redact secrets from logs, and include task ID and UTC time when reporting a problem.

Start with the runnable quickstart and check the current API reference for request fields and limits.

Related product pages