🧭 Integration Flow
① Apply for a Key
Submit your company and use case; the request enters the boss approval queue (PENDING). On approval an AppKey & AppSecret are issued (this demo only records the request — no real key is issued).
② Signed Auth
Every request carries an X-App-Key header plus an HMAC-SHA256 signature of 'timestamp + body' made with the AppSecret, sent in the X-Sign header; signatures expire after 5 minutes.
③ Call the API
All endpoints take POSTed JSON under /openapi/v1/...; synchronous APIs return results immediately, heavy jobs (bulk mockup/matting) return a task_id into an async queue.
④ Async Callbacks
When an async job finishes, results are pushed to your registered callback_url (with task_id and artifact URLs); failures retry 3 times, and you can always poll by task_id.
✍️ Auth & Signing
X-App-Key: ak_live_SIM8x2kQ X-Timestamp: 1737000000 X-Sign: hex( HMAC_SHA256( AppSecret, timestamp + "\n" + body ) )